Mac Tips and "How To" On a Mac

Shellshock Vulnerability Test and Fix

2014-09-25T12:19:00.003-04:00

Hello Gregorious

Sept 25, 2014: A major vulnerability was discovered on Bash, affecting OS X
That vulnerability, dubbed Shellshock or Bash Bug is a 10 out of 10 in the clusterf**k scale. it is really serious.
You are urged to, at least, check if your system is affected, and secondly to patch that vulnerability as soon as you can.

Apple Update!
Apple has (finally) released a Bash updates for Lion, Mountain Lion and Mavericks.
All users are highly recommended to update to the latest Bash version 3.2.53(1) to patch the recently found Shellshock / BashBug Vulnerability.

As of Oct 1st, the update for 10.9 is not yet available through OS X Software Update. The updates are available for download and install here:

OS X Lion http://support.apple.com/kb/DL1767
OS X Mountain Lion http://support.apple.com/kb/DL1768 –
OS X Mavericks http://support.apple.com/kb/DL1769

As of Oct 1st, 7:00 AM EST, the following is depreciated, unless you are still on 10.6 (Snow Leopard) or below.

Update Sept 26:
>>> DO NOT USE "Tools" or "Apps" downloaded from the Internet that pretends to fix that bug: Phising attempts / Worms have already been reported.
Only trust genuine patches i.e Apple inc.
See also bottom of the page for extra precautions.

Update Sept 27:

The vulnerability has been downgraded for OSX, A statement from Apple sent to CNET points out that:
"The vast majority of OS X users are not at risk to recently reported bash vulnerabilities," an emailed statement from Apple to CNET said.
"Bash, a UNIX command shell and language included in OS X, has a weakness that could allow unauthorized users to remotely gain control of vulnerable systems," it continues. "With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services. We are working to quickly provide a software update for our advanced UNIX users." (source: CNET)

Other reliable sources have also tested the bug and found that dhcp was "safe" on OS X.

Nevertheless, other reliable sources are less certain and still recommend patching.
Until an official patch has been released, I would use caution. I will let you decide.

How to check:
Open Terminal
Type (or copy/paste) the following command line (Verbatim)

env x='() { :;}; echo vulnerable' bash -c 'echo hello'

If you system is vulnerable to Shellshock, you will see "vulnerable hello"

If your system is safe from Shellshock, you should see something as:

$ env X='() { (a)=>\' sh -c "echo date"; cat echo
sh: X: line 1: syntax error near unexpected token `='
sh: X: line 1: `'
sh: error importing function definition for `X'

The fix:

In Terminal:
>> Note: Do not type the $ sign, it's the indication that you have to enter that line in Terminal and execute.
Note: You MUST have Xcode installed
Note: You MUST have Xcode installed
Note: READ the above again

$ mkdir bash-fix
$ cd bash-fix
$ curl https://opensource.apple.com/tarballs/bash/bash-92.tar.gz | tar zxf -
$ cd bash-92/bash-3.2
$ curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 | patch -p0
$ cd ..
$ xcodebuild
$ sudo cp /bin/bash /bin/bash.old
$ sudo cp /bin/sh /bin/sh.old
$ build/Release/bash --version # GNU bash, version 3.2.52(1)-release
$ build/Release/sh --version # GNU bash, version 3.2.52(1)-release
$ sudo cp build/Release/bash /bin
$ sudo cp build/Release/sh /bin
$ sudo -K

Then check the install and version:
$ bash --version

The answer should be:

GNU bash, version 3.2.52(1)-release (x86_64-apple-darwin13)
Copyright (C) 2007 Free Software Foundation, Inc.

Then Re-Test for the vulnerability:
$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'

Vulnerability seems to be Gone! :)
You're a bit safer now! Now wait for an official update

For security purpose, and after having tested that your Terminal and Bash are working properly,It is recommended that you chmod -x the old Bash versions to ensure they aren't re-used without your consent, or you could move the old bash to a backup/new  location.

Type/copy
$ sudo chmod a-x /bin/bash.old /bin/sh.old

If you have Homebrew, you should also update it.
Do you have Homebrew?
Well...
In Terminal, type
$ brew --version
If "command not found" You don't have it.
If you see a version, you have have, and thou shall update it ..

What is Bash?
Bash stands for Bourne Again Shell.
It's an extremely powerful command operator that allows you to do pretty much anything.

If you are not familiar with Bash, or Unix like command lines operator, I would suggest that you review/learn the basic of it:

Learning Unix for OS X: Going Deep With the Terminal and Shell

The Linux Command Line: A Complete Introduction

Troubleshooting:
- When something is b0rken, always double check the spelling, especially with Terminal and Bash.
- With the command

$ xcodebuild  you get a "Agreeing to the Xcode/iOS license requires admin privileges, please re-run as root via sudo."

>> Enter "sudo xcodebuild" and then follow the instruction up till you see the "Agree, cancel, print" message

Extra precaution:

It's only been 24hrs, and we already see worms and hackers attempting to use Shellshock. Nobody is really sure about the implications and breadth of this issue, as such I would highly recommend to:

1- Keep an eye opened for an official Apple patch

2- Just in case, install a free antivirus/malware for Mac such as Sophos Home Edition. Repeat: Free, don't fall for the premium. An Antivirus / Antimalware does not protect against Shellshock, but could prevent you from installing a "loaded" app

Top 100 Worst Passwords of All Time

2014-04-26T18:29:00.002-04:00

This list is a compilation of 49 leaks and hacks that were made public.
The Master Passwords 2014 Wordlist is composed of about 598,712,000 real passwords.
The details are explained below in the < Rant > part.

If anyone has news about:
1) WPT Amateur Poker League
2) eBay
Please let me know, we could find a mutually beneficial exchange of information.

I have bad news for you:
In the past 20 years, computers have evolved incredibly fast. Alas, our brains did not and people are still really bad at picking passwords. As we've been stuck with the same brain for a while, we tend to think alike and people keep on picking the same (bad) passwords, or patterns over and over again. The bad news? a quick statistical analysis will provide you (or me) (or the bad guy) with enough ammo to rip your

This list differs slightly from the previous with newcomers to the top 100, mainly thanks to Adobe "House-Of-Cards" Protocol: A single user can reveal the password of ~~10,000~~ 1,911,938 others (exactly) (within minutes)

Take a look below and you'll be surprised.

The full Master Passwords list is available here
Passwords in italic are patterns based

Rank	Count	Password	Rank	Count	Password	Rank	Count	Password

1	1343751	123456	34	34986	charlie	67	23946	internet
2	523769	123456789	35	34969	computer	68	23832	asdfasdf
3	411288	password	36	34771	asdfgh	69	23713	zxcvbnm
4	223699	12345678	37	34711	nicole	70	23508	buster
5	211665	adobe123	38	34157	michelle	71	23497	1qaz2wsx
6	146405	1234567	39	34108	superman	72	23353	asdfghjkl
7	145684	qwerty	40	33875	tigger	73	23294	555555
8	127770	111111	41	33376	chocolate	74	23026	753951
9	123196	12345	42	32941	121212	75	22795	summer
10	99254	iloveyou	43	32684	soccer	76	22786	123qwe
11	92613	123123	44	31825	fuckyou	77	22636	alexander
12	89501	000000	45	30539	football	78	22594	rockyou
13	89196	abc123	46	29749	jordan	79	22474	killer
14	85660	1234567890	47	29309	master	80	22198	pepper
15	83473	photoshop	48	28928	jennifer	81	22109	fdsa
16	63929	princess	49	28842	987654321	82	21919	asdasd
17	63158	1234	50	28760	112233	83	21470	qazwsx
18	57964	654321	51	28538	liverpool	84	21135	222222
19	56758	adobe1	52	28516	hannah	85	20920	ginger
20	56680	macromedia	53	27841	adobeadobe	86	20470	freedom
21	49519	azerty	54	27459	qwertyuiop	87	20329	trustno1
22	48551	monkey	55	27337	purple	88	20192	samsung
23	47852	sunshine	56	27321	andrea	89	20094	abcd1234
24	47325	aaaaaa	57	26987	thomas	90	20030	dreamweaver
25	45067	666666	58	26340	joshua	91	19950	abcdef
26	44412	daniel	59	25745	andrew	92	19811	102030
27	42761	michael	60	25636	welcome	93	19374	11111111
28	40643	password1	61	25596	secret	94	19017	123654
29	39260	123321	62	25250	whatever	95	18965	123123123
30	38144	jessica	63	24564	7777777	96	18022	abc
31	36577	shadow	64	24221	1q2w3e4r	97	17981	matrix
32	36170	letmein	65	24103	maggie	98	17166	1q2w3e
33	35385	dragon	66	24049	baseball	99	17056	test
						100	16600	asdfghj

< Rant >

Thank you Adobe!
Having 130 million accounts leaked online was already pretty bad, but thanks to some incredible stupidity, or disregard to your customers, you've chosen to use the same symmetric key and one bad choice after another:
1) All identical passwords have the same Key.
2) Adobe left the hint in *clear*
3) Then some people just give out their passwords, flat-out, in the "Hint" field.

A Hint is something that should somewhat subtle, alas, this is not understood by everyone.

Anyone, with two neurons connected can now collect millions of passwords with the corresponding email address. Heeeyaaaa! Spammers and criminals are thanking you!

Please allow me a small smörgåsbord of examples, with some of them waiting to receive a Darwin Award.

[edited]@yahoo.com-|-6KJbvp1JGKY=-|-Color Starts with P|--
- humm.... pellow? plue? preen? pose? Though one... purple maybe?

Now that we have a serious hint that "6KJbvp1JGKY=" equals purple, all you have to do is to confirm it: Just read the hints , they are in *clear*.

[edited]@gmail.com-|-6KJbvp1JGKY=-|-What is the color of plums?|--
[edited]@shaw.ca-|-6KJbvp1JGKY=-|-colour purple|--
[edited]@hotmail.com-|-6KJbvp1JGKY=-|-a color almost the same as violet|--
[edited]@msn.com-|-6KJbvp1JGKY=-|-p u r p l e ( NO SPACE )|--

Then you have little doubt left "6KJbvp1JGKY=" is for "purple"

If you Grep the file for "6KJbvp1JGKY=" anyone can quickly count how many times it appears: 16,092 times.
In 30 seconds, you've discovered 16,000 accounts (passwords and emails)
The major issue with leaving the hints in clear is a house of cards effect: Not only it affects directly multiple accounts (One user will reveal the password of many), but also can branch out far and wide: A house of cards AND a snowball effect, making it a perfect storm.
Someone may have used an unguessable hint, but it will be revealed anyway by the ECB encryption: Same key = Same password
[edited]@yahoo.com-|-6KJbvp1JGKY=-|-myspace password|--

Even if "[edited]@yahoo.com" did not reveal his password, "[edited]@shaw.ca" did it for him, and for 2 different accounts. you now have his Adobe account and his Myspace account too.

Having your Myspace or FB account hacked is not funny, but hey, you'll survive. Just tell your mom that's it's not you drunk-naked on the picture. Mention to your boss too that you never posted that his wife is an ugly fat cow.

Where it may hurt a bit more is when you leave a hint such as "Same as Amazon" You may have just given someone access to your Amazon account. Is there a Credit Card number associated with it?

But hey, nobody is stupid enough to leave a hint such as this, right?

[edited]=-|-amazonpass|--
[edited]=-|-same as amazon|--
[edited]=-|-same as amazon|--
[edited]=-|-same as amazon|--
[edited]=-|-same as amazon pass|--
[edited]=-|-same as computer, same as amazon account|--
[edited]=-|-amazon account password is the same|--

And that goes on for hundreds of them....

So thanks a lot! Lemme order few things on Amazon... I always wanted a good GPU or two ( 2880 CUDA cores :) Coupled with JTR or Hashcat, It's going to be fun ... few million hash per second...
Plus, thanks to Adobe, you're paying ...

All you have to do is to sort the file by encryption key, and read a bit. Within minutes you'll have 1000's of accounts and within 2 hours, with a little grep, you'll get 1,341,000 accounts & passwords without a sweat.

Knowing that 45-50% of people re-use their password on other sites, one could imagine the tally: 625,000 reusable passwords

So why Adobe, a company with a lot of resources, did such a bad job at protecting your account?
The answer resides in the fact that it's cheaper and faster to have a lawyer releasing a carefully crafted PR statement rather than spending some money (and time) protecting your account.

< Rant/ >

So, why is it bad? and what can YOU do to protect, not only your account, but also your bank account? If you've read the PR release from Adobe, you'll have noticed that they *think* that no credit cards numbers were accessed in *clear*

The real scary part is that about 50% of the people re-use the same passwords again and again: A quick grep over "always" "identical" "same" and "usual" returns over 1 million hits.
Then, sifting trough the hints, you find the scary ones: "same email pass" "same as student loan" "same as email" "same Amazon"

And then comes the King of the Kings: "same as bank" and "same as social".
Ditto, hundreds of them! They are begging to be Pwned or financially raped.

So, dear Uber-Moron, thanks a lot for telling *in clear* where someone should hit you.

Being able to access your email is already pretty scary: Forget Pwning your Facebook account, Accessing your emails and looking for bank or loan info, etc. Then kicking you of your own email account and requesting a password change for your bank....

But you think that been owned and pwned that bad cannot happen to you? Nope, Just take a look at Gawker, with his CEO using "24862486" as his password or this other CEO, of an Internet security company, mind you, getting so Pwned that he could not sit for weeks.

5 Easy Way To Speed Up Your Mac

2014-04-03T13:00:00.000-04:00

With time, your machine seems to be slower, no?
Here is 5 easy way to improve performances and speed up the whole thing.

Foreword and warning:
-You could be tempted to use an app called MacKeeper. Me, myself and I, DO NOT recommend at all the use of this... well, this thing.
Some call it MacKrapper, and I concur 100%.

- Backup your stuff. Always. Always backup your stuff.
For that, there is Time Machine, or even better a Time Capsule. I can not praise enough Time Machine, and when coupled with a Time Capsule, it's nothing short of orgasmic. See under External HDD, I'll show you a fantastic way to backup your stuff and bullet proof your life.

This article has 2 sections: The easy-quicky way, and the deep cleaning

Easy-Quicky

Start Up Items
Yes, it's cool to have 5 apps opening at boot, but you are draining your system right from the start.
If you can avoid it, it's better. Furthermore, you are unlikely to use 3 or 5 apps right from the start.
Also, take a look at your Menu bar: having 10 items up there does no good for you: You most likely will only use a few.
Go to System Preferences > Users and Groups > Login Items
Uncheck at will. I roughly uncheck everything but the critical.

Purge
A quick and very easy way to purge your RAM: Open Terminal and just type "purge" , without the quotes you silly! Don't forget to press enter! (#justsayin')
You need 10.7 + for purge

Widgets
Ditto, get rid of what you don't use. Furthermore, if you really miss them, you can always re-install them in a click.

Add More RAM (memory)
Yes, it costs, but there is no secret! Adding more RAM will greatly increase the performances of your machine, it's by far the most efficient fix.
You do not need to buy your RAM from Apple, as they charge way too much!
This 16GB DDR3 1600 MHz module cost less than $125, compared to the $300 - $400 charged by Apple.

Why:
When your memory start to run low, your OS will "swap" electronic memory to "virtual" memory. Virtual memory is nothing less than Hard Drive space used as memory. The issue is that the speed (Read/Write) of an Hard Drive compared to pure electronic memory is much slower... hence it simply takes more time and make your computer appears to be sluggish.

- If you do not know what type of memory you need, check under "About this Mac" > More Info > Memory
- If you do not know how to change the memory, follow this link
- Be aware that some iMac, i.e 21.5 inches cannot have a memory upgrade

- Pairing the memory:
☞ If you have only 2 slots, (i.e Mac Mini, most of Macbook, Macbook pro, Macbook air) you will have to change the memory completely: It is NOT recommended to add just one memory: You cannot have one 2 GB and one 4 GB. Mixing memory modules only works if you have 4 memory slots.
If you have 2 memory slot, you'll have to change both and get the same size, i.e 2x4GB or 2x8GB
☞ If you have 4 memory slots, i.e iMac 27inches, you can add more memory by pairing it correctly, hence you do NOT have to change all the memory modules
Example: You already have 4GB, and want to upgrade to 24 GB by adding 16GB as 2x8 GB

(iMac is upright)
Slot 1 --> 4GB (Top)
Slot 2 --> 8 GB
Slot 3 --> 4GB
Slot 4 --> 8 GB (Bottom)

De-cluster
Easier said than done, but you probably have more junk on your hard drive than you would admit. I know, it's a tedious job that nobody wants to do, but it works ...
So here is an easy way to de-cluster:

Get yourself a copy of:
- Trial version of the "Classic" Clean My Mac, not the new "Clean My Mac 2"
- Free copy of App Cleaner

Run the trial version of Clean My Mac, there is a limit of ~500MB
Be careful and read the preference pane.

As you can see, just Google Earth and Garmin account for 6GB of space.
Once you have reached the limit, close the app and run App Cleaner on Clean My Mac and select ONLY the plist, delete the Plist, and re-start Clean My Mac

Automagically, you'll restart with a brand new trial version.
You can do the same by manually deleting the plist file located at: ~/Library/Preferences/com.macpaw.CleanMyMac.plist

Remove Un-used and obsolete Apps
Now that you have App Cleaner, use it. You can trash those apps that you have not used for the past 2 years.

Reboot
I have seen Macs with 60 days+ without a reboot
From time to time, it's a good idea to reboot: it takes 20 sec and will give your machine a breather, clears the swap and RAM

Deep Cleaning

Once you've done all of the above, let's go a little deeper ...
Repeat: Adding RAM is what will make the most serious difference.
Furthermore: As the upgrade for Mavericks is free, a lot of people have upgraded directly from 10.6.8 and then realized that their Mac got a little bit sluggish. Well... RAM my friend! 10.6.8 was able to run on 1GB RAM, not so much for Mavericks! That's what 10.9 uses for a snack.

Repair permissions
Go get yourself a free copy of Onyx and run it.
Be careful with Onyx, it's powerful...

Once done, go take a look under "cleaning" Use with caution, i.e "cookies"
always check the big offenders, Firefox, Google Earth, etc are Cache Hogs.
Check also your logs, some people like to keep them, some don't.

Unused Languages, part 2
Delete unused languages (Klingon, Uzbek, Telugu, Etc ) with Monolingual
Monolingual removes more languages than Clean My Mac
Proof? 628MB of languages removed after cleaning with Clean My Mac ...

DO NOT REMOVE ENGLISH! Some apps will only work with English.
Check carefully the languages that you remove!

Deep De-Cluster

That's the most painful and tedious for me, so I took the easy solution:
Get yourself an external HDD and bullet proof your Digital Life. Here is how:

- You can find a 1TB External HDD USB 3 for less than $70 w/ free shipping. Get one!
- Get yourself a copy of Carbon Copy Cloner (Donation-ware)
- Partition your HDD in 1,2 or 3 partitions if you want to. (With DiskUtility, it's very easy)

1) Carbon copy your HDD and transfer the copy to your external HDD
- You have now a fail safe exact replica of your Mac OS, with everything, shall your Mac HDD fail, or you Mac altogether AKA Starbucks accident! you can now boot with the USB (just hold the option key at boot) and have your life back.
You can also also boot on any Mac, if you have fried your Mac, you can use a second Mac, or even go to an Apple Store and explain the situation...

2) If you have selected a multiple partition, you can have a either a multiboot drive i.e OS X and Ubuntu or Windows
Or
3) A carbon copy of your present OS + another OS + a partition used as backup for your files and junk.

Now that you have everything backed up, let's go into the work ...

Big offenders

Get yourself a free copy of Disk Inventory X, install and run it
You'll get a picture of where your space went..
You can now move your big files to your External HDD, or zap' em
A quick check on my HDD revealed 24+ GB of old iMovies, junk etc ... now gone or saved elsewhere

Mac Mail
If like me you've kept all your email since the birth of Jesus, you have a ton of junk.
It's time to trim the fat out of Mac Mail
- Sort by size and delete those funny videos that you have not watched for the last 3 years, etc ...
- Search for the word "unsubscribe" in your email: You'll find a zillion marketing emails that you don't care about.
Look for those pictures that are also in iPhoto, in Dropbox and also in your email: Yes, you have 3 copies...

Find Duplicates
That's tedious, and takes a long time, but it may be worth it.
Always be cautious when removing duplicates! Thread lightly and always double check.

Dupe Guru is a "Fairware", without buying it, you can only remove 10 dupes at a time

Magician can also find dupes, it's free, but will ask for an email (?) it's an ok App, but only scans by folder (to compare). I make no warranty whatsoever about Magician. It does also other stuff and feel like an "Everything on you plate" kinda menu. I mean that they serve you the ice-cream on top of your steak.

MacKeeper I'd rather burn my Mac than install that crapware. It's App Porn. They have a bad, bad, bad karma. If you wish to spend money, then do it properly, for a good App: Araxis has a 7 days trial.

Finder anyone?
Finder has a little "+" button, often overlooked.
Once you click it, you'll find a zillion ways to search for specifics. It goes as far as finding pictures taken with the flash "on" with a specific aperture.

Defragmenter
Without going too deep into the intricate details of OS X, you do NOT need to defragment OS X. "When writing files, Mac OS X optimizes your disk space and avoids fragmenting large files into smaller segments"
That's it. Buying a defragmenter for Mac is money down the drain.
Also, if you have an SSD, (Solid State Drive) defragmenting is NOT recommended at all. Don't do it.

John The Ripper Tutorial, Examples and Optimization

2012-09-05T17:22:00.000-04:00

John The Ripper Mac Installation, Tutorial and Optimization

A while ago, I wrote this tutorial on how to install the simple version (pre-compiled) of John The Ripper on a Mac

It's now time to optimize John. Why? it's working!

Yes, it's working, but can you make it work much better?

John The Ripper, AKA John/JTR is the extreme opposite of intuitive, and unless you are an UberGeek, you've probably missed out few subtleties.
Secondly, John The Ripper is a bit like a Muscle Car delivered from the factory with the "Eco" settings enabled by default. If you want the "Muscle", you'll have to open the hood. Once done, you'll get more muscle than you can probably chew on.

Subtleties?

Well, for a start, the precompiled version on OSX does not use all cores, the "compiled on site" can ...

So if you have a quad-core, you'll make a 196% speed improvement, and that's only on raw benchmark.
The default password list is absolute crap, and the configuration could use a few improvements.

When you'll start playing just with those 2, the result(s) could be as shown below.

Deemed worth reading?
Ok?

Let's install it ...

1- You'll need Xcode, if not already installed, download it , it's free.
Open App Store, search XCode, download and install.
The install is going to take some time....
☞ If you wonder if you have Xcode installed, just open terminal and type gcc


The "no input file" is a good sign. Otherwise, install it.

1a- If you do not wish to install Xcode, you can always refer to here, but be kindly warned that you'll have a "less effective" version of JTR.

2- Grab a copy of the latest John The Ripper @ http://www.openwall.com/john/
look for the community enhanced version (more patches), as of today, it's the john 1.7.9 jumbo 6 2.

2a - While patiently looking at your download screen, grab a free copy of TextWrangler, not the truncated App Store Version, The full one from BareBones and install, you'll thank me later.

3- Xcode and TextWrangler have been installed, John has been downloaded, refreshments have been served.

4- Go to your "Download" directory and look for John 1.7.9.jumbo 6 tar.gz, or whatever you have downloaded, and double click on it, it will decompress it.

5- You have now a directory called John "something"
Please replace "something" in your head by the appropriate designation, i.e "John-1.7.9-jumbo 6 2"

6-Create a folder,and name it "John" anywhere on you Mac, but, recommended, that you either create it in "Macintosh HD" or your home folder, i.e ~/"myname".
Please, don't use the quotes for "John". Just John. ( Somebody is going to create a "Just john", that's guaranteed, and if you do, you will be flamed. Guaranteed too)

7- Copy all folders & files contained in "John-1.7.9-jumbo 6 2" into the newly created John folder. Only the contents, no need to copy the John-1.7.9-jumbo 6 2 folder too. If you do, you'll have to type a very long command line.

8- You have now a folder named John, with in it the 5 items as shown above.
Unfortunately, now is the time to make a choice...

Das Kompilation!

You'll have to make a choice, roughly between 32 bit, or 64 bit
64 bit seems the choice, no?    Hold your horses!

One little thing: as of now, Aug 2012, when cracking pure raw-sha1(i.e Linkedin) the 32-bit is a bit faster. (no pun intended)
For generic use, select "64 bit", for Raw-Sha1 only, go for the 32 bit sse2.
The difference is not that extreme, and lastly, the 64bit version accepts Wordlists larger than 2GB.
For UberGeeks, well... install both. Your humble servant has 3 versions (for research purpose only, I am not geeking, 2 of them will be deleted soon)

- JTR is the Mac OSX pre-built
- JTR32 is the 32bit
- JTR64 is ... well, you've guessed by now.

So, make a choice (hint: 64 bit) and we'll start...

1) Open Terminal and go to the "src" folder of John, by typing
cd /john/src                If you have placed john somewhere else, then go there...

1a) Second choice to make:
Please read carefully as it trapped me the first time:

JtR runs natively on one core.
You can safely run 2, or more instances on JtR at the same time, for instance one instance running a set of rules and the other instance running something else.

But you can also ask John to run on all cores. On Mac it's called "mpirun"
mpirun has to be enabled in the Makefile before compiling.
I highly suggest to do so, as it enable both parallel and multicore.
In order to do so:

1a) Open TextWrangler
Look for the file /John/src/makefile and open it

1b) Search for the following paragraph:

## Uncomment the TWO lines below for MPI (can be used together with OMP as well)
## If you experience problems with MPI_Barrier, remove -DJOHN_MPI_BARRIER
## If you experience problems with MPI_Abort, remove -DJOHN_MPI_ABORT
##CC = mpicc -DHAVE_MPI -DJOHN_MPI_BARRIER -DJOHN_MPI_ABORT
##MPIOBJ = john-mpi.o

1c) Un-comment the 2 last line, (remove the ##)
1d) Save

2) Decide if you wish or will attempt to Bruteforce longer than 8ch long passwords. If you don't know, don't touch it now and come back later.
If you do not want to change the max bruteforce length, Skip to directly to part 3)

Before going bonkers, read the "Bruteforcing Speed" part below, take a look at the ETA, and you'll realize that attempting a 20ch Keyspace is not really feasible.
Done reading?
Ok, Here is how you can force JtR to Bruteforce longer than 8ch long.

2a) Open TextWrangler
Look for the file params.h in /John/src and open it
In that file, look for the section:
#define CHARSET_MIN           ' '
#define CHARSET_MAX           0x7E
#define CHARSET_SIZE           (CHARSET_MAX - CHARSET_MIN + 1)
#define CHARSET_LENGTH            8

2b) Change the 8 into what you want, i.e 15 or 30.
#define CHARSET_MIN           ' '
#define CHARSET_MAX           0x7E
#define CHARSET_SIZE           (CHARSET_MAX - CHARSET_MIN + 1)
#define CHARSET_LENGTH            15

☞ Warning: There are spaces and tabs, don't replace them by "spaces"
Use the Show Invisible in Text Wrangler.

2c) Save the file params.h and go to part 3) compilation.
Once the compilation is done, Go to "Charset making "for the final part. (did I mention that you'll have to go under the hood?)

We can now start the compilation. In /John/src

3) In /John/src, type exactly, or copy/paste
    - for the 32 bit version:   make clean macosx-x86-sse2
    - for the 64 bit version:   make clean macosx-x86-64

Hit "Return" and plenty of things will appear on terminal screen, don't panic.
While waiting, and for the curious, you can open the file "makefile" with textwrangler and look at all the options, just in case you want to install JTR on a PowerPC Mac
The compile options look like:

@echo "macosx-x86-64            Mac OS X 10.5+, Xcode 3.0+, x86-64 with SSE2 (best)"
@echo "macosx-x86-64-opencl     Mac OS X 10.5+, Xcode 3.0+, x86-64 with SSE2, OpenCL support"
@echo "macosx-x86-sse2          Mac OS X, x86 with SSE2"
@echo "macosx-ppc64             Mac OS X 10.4+, PowerPC 64-bit"
@echo "macosx-universal         Mac OS X, Universal Binary (x86 + x86-64 + PPC)"

You'll also find all Linux options, just in case ....

4) Now that the install is done, test it by typing
     cd /john/run

  ./john

☞ Warning: the ./ are mandatory and you must be in the proper /run directory
If you try "john" as is, you'll receive an error.

You should see the short help for John The Ripper

If you see something like that:
bash: ./john: No such file or directory
it means that, either: The compilation has failed, or, that you have not typed the proper path/command. In both case, retry or re-read the above. All of it: You've failed once and that's probably for a good reason: rtfm!

Das Optimization!

We're going to glide over few things rapidly, for a deeper look at what does what, there is a folder named "doc" , inside they have docs!. Yay!

1) John, by default, runs on one core only. If you have a single core, it's good news, otherwise not so much. So let's test it , and type

./john --test=10 --format=raw-sha1-linkedin

after 10 sec, you see something like:
Benchmarking: Raw SHA-1 LinkedIn [128/128 SSE2 4x]... DONE
Raw: 9540K c/s real, 9559K c/s virtual

Now, let's try something else, type

mpirun -np 2 ./john --test=10 --format=raw-sha1-linkedin

And the results are:
Benchmarking: Raw SHA-1 LinkedIn [128/128 SSE2 4x]... (2xMPI) DONE
Raw: 17655K c/s real, 18923K c/s virtual

This time, we were twice as fast. Yup! 2 cores. So if you have a quad core, try the "mpirun -np 4". (yes, Mr Trae, that's why your quadcore is apparently slower than my dual)

john.conf

2) Open Textwrangler app, and look for a file named john.conf in /john/run
open that file and make right away a backup, that you will intelligently call "backup_john.conf".
In this john.conf, you'll find roughly 2 types of configuration: General config and Rules config.
For instance look at the line:

# Use idle cycles only
Idle = Y

it means that John will only use the CPU power left Vs. requesting full power, hence you could (should) switch it to "No"

# Use idle cycles only
Idle = N

Look at the other options and choose what you want on/off. As a rule of thumb, don't finagle too much if you don't understand it, i.e trying funky settings such as [Incremental:All] MaxLen = 99
Still, you have a backup now, don't you? :) , so you can play a little...

2a) As we are going to talk about Wordlist, think about that line:
# Wordlist file name, to be used in batch mode
Wordlist = $JOHN/password.lst

the default wordlist in John is password.lst , and is crap. Using this wordlist will not take you far at all.

2b) if you have changed the name of the main directory for John, i.e JTR, you should change the parameter to $JTR/password.lst
2c) ditto with the password.lst, if you use mydic.txt , then change it too.
the easiest way is simply to keep the name password.lst, or to use the --wordlist option

2d) Wordlist itself
As mentioned above, the default password.lst is crap. if your wish to run john for weeks on end, keep it. Otherwise, get this Wordlist

Here is why: on default mode , John will first try the wordlist "as is" , then mingle it with rules contained in John.conf under [List.Rules:SIngle] for "Single crack Mode"
Once done, it will switch to incremental mode, All alphanumerical characters. one by one.
Problem: You are now at day 3, and you are seeing 0.00% progress. Why?
Because you are trying all possible combinations of 1 to 8 ch long, over 95 possible characters. it's called the Keyspace and that number is 6,704,780,954,517,120

it simply means that you'll see progress at 0.00% for few weeks....See you in 3 months...
In John the default length is 8 max and that also mean that a 10 ch long password will not be (cannot be cracked for sure) by the "All" method alone unless you go under the hood as explained below.
Bruteforce is, generally, and should be considered as the last resort: it very slow to complete the whole keyspace.

To discourage you a bit more, look below for the speed table and the "Speed the Things Up"

So, the solution resides in: a) a very good Wordlist, b) better [Rules] AKA "iRules" and some "finesse"
For instance, most websites today requires at 6 to 8 characters, made of at least numbers and letters, and sometimes number(s), letters and signs.
Bad news:    It's longer to crack
Good news: The brain size of the average human has NOT increased that much

Hence, before, the dummy would have used "password" as password. Now they use "p@ssw0rd" or "p@55w0rd" and, as usual, people use mostly "words", as proof of concept:

lov3b3ans | Syr4cu$e | C0mmitted | fuzzym0nkey |inth3loop | L1fel0ng , etc etc

So, you end up with 3 choices.
-1 Have a 50,000 terabytes wordlist, along with 25,000 external HDD
-2 Have the patience of a buddhist monk
-3 Have an excellent wordlist coupled with intelligent rule that permutes a for @, append numbers at the end of a word, i.e linkedin1980, etc ..

And your choice is?   -3? Good answer!

☞ If you have thought about a new cracking method, It's probably already in JtR. (Matt Weir) (quoted liberally)

John will try "as is" (rule= : ) [(not ;) or ;-)] you dummy, the rule is ":"
then apply funny rules such as "<* >2 !?A l $1" which in good ol' English means: # Lowercase pure alphabetic words and append '1'

As aforementioned, the dummy is absolutely convinced that "password123", or "P@ssw0rd123" is unbreakable, or even unguessable, that is until, our brights readers think about "<* >2 !?A l $123"
Out of the first 330,000 -unique- passwords (meaning dupes removed) that (we)* have cracked from the Linkedin hash dump, 1344 instances of "123" were found, along with 100's of "love", etc etc
Do you catch my drift? The snowball effect: The more you crack, the faster you crack the rest. Up till you reach the crazy ones ... :)

4- Use the most probable rules first and the really funky last, i.e: # Really weird charset conversions, like "england" -> "rmh;smf" (shifting one key to the right)
5- Preferably use a statistically sorted Wordlist, most used first: it will greatly reduce your running time and read the "rules" in the doc folder, you'll be then able to mingle anything without using 50,000 terabytes.

6- Lastly, there is a limit (memory / preprocessor ) on the number/complexity of the rules that you apply. You can go wild, but avoid the "crazy".

The proof of concept is demonstrated in the video.

Optimized john.conf is available for download at the end, but please, read the "Read me" and the command lines first

John The Ripper Commands and examples

the main options are the following

--session=[name]
--wordlist=[path and name]
--format=[format name]
--show [path and name of the hash file]
--restore=[session name]
--rules
--config
--loopback
--markov
--mask
☞ All options have a shorthand, for sake of clarity we here use the longhand.
i.e   -ru = --rules ; -w = --wordlist. See /John/doc/examples

☞ To Abort John , use ctrl-c (control c) and NOT CTRL-Z. Also, press ctrl-c one time, not twice.

☞ We've mentioned to place John in a top directory, and to rename "john-1.7.9-jumbo-6 2" into "John". Indeed, you'll have to type command lines, and if you have placed john in a funny far-far away directory , the command line will most likely drive you crazy: Keep it simple!

☞ You can always drag and drop a file into terminal, it will automagically write the path for you. Without errors.

☞ If you do not know the hash type, john will find it for you, but it's always a bit better to force load one type of hash Vs. having John trying multiple hash, sometimes, one hash can be recognized under other names.

So, let's try John with the Linkedin dump (I suppose one could find it on the Internet with minimal Google-Fu competences)
Go to the appropriate directory AKA: /John/run and type
./john [path and name of the Linkedin hash file]

You'll see that John has found multiple possible hash and gives you (few) warnings
Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-linkedin"
Use the "--format=raw-sha1-linkedin" option to force loading these as that type instead

--format
Hence, pretty clear that you should use, in that case, --format=raw-sha1-linkedin
So the command line goes as:
./john --format=raw-sha1-linkedin [path and name of the hash file]

--session
The --session option allows you to stop a session and restart where you left it later, useful, huh? Then use it!

./john -- session=linkedin --format=raw-sha1-linkedin [path and name of the hash file]

--restore
the --restore option allows you to restart an interupted session, with all the previous parameter just where you left it, pretty handy, huh?

/john -- restore=linkedin

--mask
the --mask option allows you to search a specific keyspace: If you have a good idea of what the password(s) could be, the mask option could save you a billion years or two. (not kidding)

Let's pretend that you forgot a password, and that somehow, you rememberer that it was composed of 3 digits, 3 letters and 3 signs.
?A is for everything
?a is for printable ASCII (English characters only, no funny è or ù)
?d is for digit
?l is for letters
?s is for signs

hence   --mask=?d?d?d?l?l?l?s?s?s

Now, if you were fortunate enough to remember chunks of it, i.e. 123????@?, you could mask such as --mask=123?l?l?l?s@?s hence reducing the keyspace to 19,140,264 possible passwords candidates.

  --wordlist
The --wordlist option is for a ... wordlist! yay! with the path if necessary.
If like me you have decided to rename your John directory into JTR, it is suggested that you use the --wordlist option , that is, if you have left your john.conf alone , see line    Wordlist = $JOHN/password.lst in file john.conf
☞ Warning! on the 32bit version, if you attempt to use a --wordlist option with a dictionary greater than 2GB you may receive the following error: Error, dictionary file is empty.
1) count the lines with wc -l [filename]
1a) Divide by 2 (roughly) , and round it up to the next integer (full number)
2) Split the dictionary with split -l [#lines] . the output by default is xaa, xab, xac etc .
3) Don't use the the option by size , you'll end up cutting a password in 2.

./john -- session=linkedin --wordlist=masterpswd.txt --format=raw-sha1-linkedin [path and name of the hash file]

Loading multiple wordlists at once

John does not allow, by default, to load multiple Wordlists at once, but you can trick him.
The most probable reason why the maker of JtR have not implemented this option by default resides in a word of caution:   Rules are going to be applied as described in your "whatever.conf"
Loading 300 million lines is one thing, having rules applied to 300 million is another altogether:   If your Rules generate an output of 10,000 variations on ONE password, one could expect the simple math to be 10,000*300,000,000 = See you in 3 years
Hence: CURB YOUR ENTHUSIASM!
If you wish to do a quick chop-chop on large set of wordlists, edit/create a specific .conf file with very simple and very fast rules, i.e :,l,u,S , etc.
See /doc/Rules and what's below under --rules and --config

1) Create a directory in /John and name it "Wlist" or "Store". Anything you want but keep it short.
2) Place in it your favorites Wordlists, avoiding repeats and duplicates, even in the wordlists.
Solution: Where "Wlist" is the directory containing your Wordlists, and grabthefiles, an argument. You can replace grabmethefiles by anything that fits your mood.
Type: ls /John/Wlist | xargs -t -I grabthefiles ./john --session=xargs --wordlist=/John/Wlist/grabthefiles --rules [etc etc..... ]

☞ " xargs -t -I " it's a overscore "i" , not a l,L or | --> "xargs -t -I"
☞ xargs calls multiple times the same ./john command line changing each time for the correct wordlist, be aware that it is highly recommended to use --session otherwise, if you have to pause you'll have to restart from scratch.
The ETA is for each wordlists and not for the total time.

--rules

The --rules option call for a specific set of rules as defined in John.conf under names such as [List.Rules:Wordlist]
using --rules will call for all the rules, if you want to use only a specific set, i.e wordlist, then use --rules=wordlist
./john -- session=linkedin --wordlist=masterpswd.txt --rules=wordlist --format=[hash format] [path and name of the hash file]
☞ Be aware that calling a large set of rules could lead to some extra-extra time, always check that you are not performing a duplicate work. i.e calling twice the same rule or asking to lowercase an already all lower case wordlist.
☞ Rules are processed by a preprocessor. Writing extremely large rules or set of rules will send your memory usage off the chart. See John.log

--show

The option --show shows you the cracked hashes, it's best used with a redirection to a file
./john -- show [path and name of the hash file] > showpass.txt
To see what's left to crack, use --show=left
☞ The option --show works faster if you include the --format option
./john --show=left --format=[name] [path and name of the hash file] > showhash.txt

--config
The option --config=[name] allows you to use multiple configurations and set of rules. You can create your own configuration files and use it at will, i.e a "mini.conf" configuration to crack the easy one first. Don't forget that a wordlist that have 100m passphrases in it, mingled with 100 rules equals a 100x100m words equivalent. Translated in space, it like having, about, 95,000 MB worth of space. 95 TeraBytes
☞ See at the end for downloadable Config/Rules files
☞ See "Making List.Rules" before making 99 different config files

--loopback
--loop
A rarely used option. Too bad, it's a good one! The --loopback allows you to check against your john.pot file. You have already cracked some passwords and they are all stored in john.pot, hence you can re-use them for a quick check.
For a longer check, I'll give you a hint: those are real passwords: the ham not the spam! so re-use them with rules: If you have found "password" , you'll find "password123"

--Markov
A statistical attack derived from probabilistic stochastic processes. AKA Markov's Chains.
I am scaring the shit of of you with Markov, huh? I am not?

Well... don't be afraid ... I don't understand it myself. I read what I could, got a serious headache and decided not to pursue.
All I know is that it's working!
As a matter of fact it's working pretty darn well and it's really fast too.

Mr Andrey (Andrei) Andreyevich Markov (1856-1922) must be thrilled to know that we're all very satisfied with his research. Thank you Mr Markov!
As I don't understand the intricate details of Mr Markov thoughts, I switched to a highly scientific proven method: "The Empirical Poke Around"™

Hence, I poked around. Empirically.

First things first.

1) grab a high quality password file. Please be sure to use a US95 ASCII txt file (no é or ñ) unless you are using the -p option
2) in /John/run type ./calc_stat <name of dictionary file> stats

3) let it work, it should take about 10 min, based on the Dic size.

When done type your average John command line, this time, include --Markov

./John --markov [path and name of hash file]

On the screen you'll see something as: MKV start (stats=$JOHN/stats, lvl=200 len=12 pwd=238032699)

and rapidly, Mr Markov will go to work ...

len=12 is the max password length to be tested

lvl=200 is the level.

pwd=238,032,699 is ...well, you've guessed.

"lvl" is what is going to increase or decrease the number of password generated. Try to stick between 200 and 250. At 300 my config generated 6,243,105,973,969 passwords. It's a bit too much. See the "Empirical Poke Around Graph"

You can modify those parameters in John.conf , or directly with --markov[modes]

./john --markov=230:0:0:12 (level, start, end, length)
The 0:0 values are start/end in %. 0:0 being the default, otherwise you need to put a %. i.e --markov=200:10%:20%:12

☞ Be aware that there is a bit of a catch: The Markov's Swiss Cheese Illogism™
- The lower the level, the lower the number of password generated, but the greater the quality, hence the fastest time... To crack the lowest amount of hashes.
- On the other hand: The higher the level, the greater the number of passwords generated, but with the lowest quality, hence the longest time... To crack the highest amount of hashes.
Do you follow me? The more holes in cheese, the less cheese. But the less cheese, the more holes. If the more holes, the more cheese. Hence more holes = more cheese.
Roughly to say that if you push the enceloppe a bit too high, you'll have such a large number of possibilities that you'll be close to bruteforcing. Keep the numbers between 150 and 250. (Surprise, the default value is 200)

Markvov Vs. Bruteforcing

I had about 1.5 million hashes left and it was getting harder to crack the remaining ones. Then I decided to test Markov Vs Bruteforcing, the -surprising- results are as follow:

Markov:             guesses: 18,072 time: 0:01:30:00     c/s: 6654G
Bruteforce:        guesses:   4,590 time: 1:07:04:57     c/s: 3817G

c/s Speed:          Markov is 74% Faster than bruteforce: More bang for your buck!
r/t ( Passwords recovered / Tries ) Markov wins!
Recovery speed: Markov recovered 3.34 pswd/sec on average, Bruteforce 0.85 pswd/sec, which make Markov 394% faster
Markov will not recover all passwords, and cannot guess true random one, but you can attempt passwords length greater than bruteforce, on the other hand Bruteforce will recover any password under 10ch long. If you have the time.

EPAG
Empirical Poke Around Graph

John.pot

John keeps a list of already cracked hash in run/John.pot, keep that file safe ...
the format looks like:
$dynamic_26$32bf58ba66ef765e214ca1b6fe70244dfe5b5427:link@din2010
[header:hash:password]
You can easily trim the fat with cut -c 51- [filename] > output.txt
51- being the # of ch to remove. yes, it is "51 dash" "dash 51" will leave the first 51 ch.

As many times mentioned, because we've found "link@din2010" , one could bet that we will find something close to it. Another genius has thought very hard and used "name of the website + year" or something in the same family ... So of course, we found relatives...
Here is the brother ...
2ce773d7ffbbe7491e51272783d1c6f411a1d34b:link@din2012

And the uncles...
033a2970983d5675152a6213d7d4228bc977399c:linkedinpass1234
6a9535be0d9ef156d5fa7465bd419d15843bb2b0:linkedinpass1402
01679a9ea64997f7e693159670329061c9dd22c3:linkedinpass1423
5077ab2005d5253f9b55b9b0979aa9401fcad706:linkedinpass1704

Bruteforce Vs. Wordlists + Rules
Bruteforce is extremely, extremely time consuming and should be used only as last resort, specifically for long -er passwords: Bruteforcing 2 to 5 ch long is fairly fast and easy, 6 to 7 is medium, 8 and above will test your determination. No need to mention 15 or 16...
Hence, you've already cracked the easy ones... i.e "password" you might want to re-use them.

As mentioned above, john.pot keeps track of the hashes previously cracked and will skip them and it's a good thing: No need to work on already cracked hashes. You should always try to chop-chop trough the easy ones first, then use bruteforce on last resort for the complex ones.

If you find "Linkedin", an (existing) rule can easily double the password: "LinkedinLinkedin" , then once either re-injected in a dictionary, re-used with --loopback or created via Rules, you could find "LinkedinLinkedin2012" or "L!nk3d1nL!nk3d1n2012"
Finding such "L!nk3d1nL!nk3d1n" by mean of simple bruteforce is not a job for you! it's a job for your grandgrandgrandgrand son, or daughter: Seriously, limit yourself to less than 8 ch long unless you own a very-very fast machine.

What Mr Dingbat could have done was to use roman characters, i.e é, ñ, an uppercase, sign, and number. i.e 1966L!ñkédin1966 That would have forced you on the whole range of printable ASCII. You will be then, pretty much dead in the water.
Don't get me wrong, it is still a stupid password because of the pattern, but it's a whole lot stronger ... by a factor of 104, or 10,406% stronger
Now, take the same stuff and use Rules .... What was extremely far far away is now feasible: we know that "linkedin" is a big fave, we know that people like appending and/or prefixing numbers, and we know that using "!" for "i" will not get you a Nobel Prize.
Proof that it's easily feasible with Rules? I did it!

Check the quick analysys of the Linkedin passwords at the end.

Bruteforcing Speed
Disclaimer: This section was specifically written to discourage you.

The good news is that JtR does not bruteforce stupidly in order (0, 00, 000 etc) JtR uses an algorithm to generate a smart-er bruteforcing order. Nevertheless...
Bruteforcing 4 ch long is very fast, 5 is ok, 6 is slow, etc
here are the speed for an average machine, one core running, No GPU, on raw sha1,
    length                Keyspace           Key/sec          Time
1 to 4 ch long                  82,317,120      ~ 2,655,391         31 Seconds
1 to 5         7,820,126,495      ~ 2,655,391         46 minutes
1 to 6                      742,912,017,120      ~ 2,655,391         73 hours
1 to 7              70,576,641,626,495     ~ 2,655,391         289 days
1 to 8           6,704,780,954,517,020    ~ 2,655,391         75 years

There you have it.
Even if you have a fast machine, you'll still be waiting for few years. In order to go into the "Weeks" or "Days", it's GPU assisted only. A good GC/GPU will take you into warp speed, tests on This Card are showing results as high as 8.2 billion passwords/second.
With a single of one of those, your ETA goes from 75 years to 23 hours.

One notable counter intuitive perception is that, the smaller the hash file, the slower the speed (in c/s, not in overall time) and not the logical opposite, and this is due on the inner working of any Cracking program, lemme explain...

A Cracking program does not "guess" or reverse engineer the hash, it simply compares it.
1) You feed the program a test password, i.e password1
2) A hash is generated: e38ad214943daad1d64c102faec29de4afe9da3d
3) The program compares it with the list you provided.
If there is a match, good news. If not, then try again with another test password.
And that's why: It's faster to compare 1 generated hash against a large list of existing ones than to have to generate a lot of hashes to compare to a small list. Generate one, compare to millions Vs. Generate millions to compare to few.
6,2 million hash list c/s speed = 4,284,000,000,000 c/s
10 (ten) hash list c/s speed =            17,859,000 c/s

Speed the thing up! (Part One)

You can go two ways: get the fastest machine or get smart:

Get smart is even faster then the fastest machine...
Get some geeky friend to help you.
1) Each member of the team choose a mode or a set of different rules, and start working on it's own piece. Going trough long rules alone can be a long long project, when the rules/modes are divided amongst individuals it works much faster.

In the mean time, share a dropbox folder with your friends.

After 45 min or so, do a ctrl-c to stop the session and do a:
./john --show [hashfile] > /dropbox/public/sharedfolder/showpass_myname.txt

Your friends having done the same, you have x password files. Use Textwrangler to concatenate them, clean and remove the dupes in it, and rename as showpass_all.txt, you can now use that file to expand your wordlist(s), i.e a common bigdic.txt that everyone will use (put the new password first) Each time someone will update the file, Dropbox will update it too, hence you always have the latest copy. Simply point John --wordlist= to that location and from time to time, restart the crack under different session name.

The concepts behind it are:
a) Distribution of the attack: You have now 12, 20 or even 40 cores working
b) Faster use of complex rules
c) Greater chances to crack reoccurring passwords much faster: In a dump like Linkedin, some patterns passwords are present up to 900 times, i.e link, l!nked!n , etc
If you had a 40 cores, you still have to go trough the hash one by one.
As you are now criss-crossing your results with your friends using a file that contains everybody's result, you do not need to spend time crack a password already found.
Remember? the first rule of wordlist is "as is"
This solution is faster than "40 cores" alone. Don't reinvent the wheel....

(we)* : Thanks to:
Terek, Score 40%
Trae,    Score 0% (aka ADHD Boy) QuadCore i7 running on one leg ;)

Speed the thing up! (Part Two)

let's be clear: Rules Rules!

Without Rules, Markov aside, you would be condemned to two main "solutions"
1) Endless Wordlist, 50,000 TeraBytes of it, and $200,000 worth of Hard Drive.
2) Bruteforcing for the next century, and a $200,000 utility bill.

Rules allow you to generate or re-generate new passwords to be tested, and also, to do it much faster than anything else, plus you would NOT have the space to store such wordlists.

The KISF Rule
Keep it Simple First!
Before going bonkers with complex rules (that will make you proud) why don't you try the simple ones first? They are fast and replicate human mnemonic patterns: Capitalize, Upper, Mirror, duplicate, etc etc. Did I mention the docs? Where rules are explained?

Rules Vs. Endless Wordlists

Rules are not as fast as reading directly, (yes, you are using some CPU/memory to generate them) but the space saved is huge. Futhermore, you can turn on/off rules, add, mingle or remove , etc. With gigormous wordlist, (aka bragging rights wordlists on the internet for 100 or 200GB list*) you have to store them, edit them -if you can-, etc . Good luck with that. The solution resides again in an excellent set of Wordlist and a solid set of rules. ( *Bragging rights: 200 GB WPA(?) Wordlist )

The caveat is that, reading rules, understanding and editing them will give you a serious headache.    Example: -[:c] l /a /l /[os] sa4 sl1 s\0\p[0$] (?\p1[za] \p1[:c]    Well, that's not the most friendly thing to understand.

...Knowing grep will help you a bit, but ... as you've read so far... you deserve a little bonus for your perseverance:

John The Ripper Rules Generator!

- Yay!

By Matt Weir **

No only you will generate rules easily, without needing a Costco sized bottle of aspirin, but you'll quickly learn the tricks and syntax. Otherwise, read the doc in JtR and order aspirin by the pound.
i.e , Swap Case of all Keyboard Values, Reverse, Concatenate, even modify the Character Set.   G-d bless you Matt Weir!

Where?          : https://sites.google.com/site/reusablesec2/jtrconfiggenerator
Prerequisite? : Xcode / gcc
How?              : sudo --user --shall readtheefingdoc
run?                : ./jtrMakeConfig
If for whatever reason you do NOT wish to use the JtR Configuration Generator, you'll want to look at one of those things... It will feel the same ... a big PIA

Nevertheless, always check your rules with a small test file, just to avoid duplicates or very slow stuff: Loading 50,000 rules is un-efficient. Having an ETA of +50 days should be a sign...Believe me, I have made mistakes ...

Strategies ..

- First, when you hear about a large dump being released, you Google it and try to find the dump. Seconds after the download started, you should start Google-ing again for the first cracked passwords: Someone out there is faster than you, has a better machine(s), and has already cracked few of them. In order to comply with the "Bragging Rights Theory", short list may have been published, those will help you a lot to start your crack. Get them, and keep on Googling from time to time.
Also, it's highly possible that by the time you find a link or a paste, the sole answer will be "content no longer available". In that case one could thank Google for the feature called Google Cache. Thank you Mr Google for that. Try it ;-)

- Start small, good dictionary, small rules: Each time a hash is cracked, it's stored in John.pot and will not be reloaded. Each time it's cracked, JtR goes faster ....
- Check the (hash) source if you can, i.e the website. For instance, American Express has stupid rules for passwords: no spaces, only % & _ ? # = - and best of all, is not case sensitive. Hence, it has greatly reduced your workload. If a website does not allow certain charaters, just don't use them. If the website has a policy of "minimum 8 ch long", don't attempt to bruteforce 0-7. You'll save few hours. (If you have ever attempted to crack a zero Ch. long password, please seek medical attention immediately)
- use --loopback and from time to time , append your wordlist with the already cracked passwords
- use pipal or PACK to generate an analysis of what's been cracked, always useful to see a pattern or the most used strings
In the case of the Linkedin dump for example, you can try a small bruteforcing in the middle, 1-6 ch long, you'll always find something to chew on, 7 ch is slow, 8 is very slow...
- use the option --mkpc=1 and check your john.log file: You'll see which rule is associated with the cracked password, then make an educated guess...

Making List.Rules
Open John.conf with TextWrangler and start looking for lines that contains [List.Rules."Whatever"]
Those are "paragraphs" stating a set of rules to be called by the option --rules="whatever"
i.e --rules=jumbo
You can create your own paragraphs with your own set of rules, i.e [List.Rules.Veryfast]
Include in it "very fast" rules such as "as is" "Capitalize" "Duplicate" etc ...
it might look like that ...

##### Veryfast #####
[List.Rules.Veryfast]
# no-op: do nothing to the input word
:
# convert to lowercase
l
# convert to uppercase
u
# capitalize
c
# lowercase the first character, and uppercase the rest
C
# toggle case of all characters in the word
t
# reverse: "Fred" -> "derF"
r
# duplicate: "Fred" -> "FredFred"
d
# reflect: "Fred" -> "FredderF"
f
# rotate the word left: "jsmith" -> "smithj"
{
# rotate the word right: "smithj" -> "jsmith"
}
##### End Of Veryfast #####

☞ Before going wild, double check that you are not calling duplicate rules, or you'll be doing double work for nothing. i.e ":" (Trying "as is", No op ) is already called in [List.Rules.Single], [List.Rules.Wordlist]. As [List.Rules.Jumbo] also calls "Wordlist", if you add an extra one, your hash will only be checked for a fourth time. ;-)

Length control
If you know that the password you are looking for is of a certain character length, or range, i.e 8ch long, there is no need for you to check anything outside that range. In that case limit the search by adding a character length limitation, you can gain a huge amount of time.
Example: limiting to 8 ch long
# Trying 8 ch long only
[List.Rules:8only]
>7'8
# End of Trying 8 ch long only

The first >7 reject any word that is less than 8 ch long
The second '8 truncates words greater than length 8

You can, of course, add this control to other rule commands, i.e
$[0-9]>7'8
The above suffix a number and limits the length of the password tested.
IF the password tested is:
America --> America0 , then America1 etc etc...
IF the password tested is:
UnitedStates --> UnitedSt   (truncated at 8, without adding the digits)

Rules that calls Rules
Look for the Rule called [List.Rules.Jumbo] and you'll quickly understand that you can call sub-rules. [List.Rules.Jumbo] calls the rules "Wordlist" then "Single" then "Extra", etc.
Example:
# For Wordlist mode and very fast hashes
[List.Rules:Jumbo]
.include [List.Rules:Wordlist]
.include [List.Rules:Single]
.include [List.Rules:Extra]
.include [List.Rules:NT]
Hence, you can also create your own [List.Rules.Myrules] by using .include [List.Rules:Whatever]
Again, be aware that some rules are going to be called twice when using "Jumbo", or that you'll call subrules twice too, hence double check -again- that your set does not call again the same rules over and over again, i.e using [List.Rules:Jumbo] and [List.Rules:Single-Extra]

Ordered Rules?

Let's go back to Mr Dingbat and Friends, The append/prefix a number to a password is obvious.   In JtR, the rule to append a digit to a password is $ "your digit" such as $a will add an "a" at the end .For a number $1, for a range $[0-9] or $[0123456789]
Got it?
$a           password >> passworda
$[123]     password >> password1, password2, password3   (no 4 and 5, you didn't ask)

To be able to add more than, you repeat ...
$[0-9]$[0-9]$[0-9]   password >> password000 to password999

hence, the following
$[0-9]
$[0-9]$[0-9]
$[0-9]$[0-9]$[0-9]
$[0-9]$[0-9]$[0-9]$[0-9]
$[0-9]$[0-9]$[0-9]$[0-9]$[0-9]
$[0-9]$[0-9]$[0-9]$[0-9]$[0-9]$[0-9]

Will go from append 0 to 999,999.   Repeat the same rule but interchange $ for ^, and you'll prefix.
You have now 999,999 + 999,000 permutation per password.
Take a 50m line wordlist and John will develop it into a virtual 99,999,950,000,000 password list. That's 99,999 billions. So, again, to wrap your mind around it, it's about 5,500 2TB Hard Drive worth of space,or in moolah: $675,000 (Geez, the money you save reading this blog)

So, Rules is a no brainer, but .... 99,999,950,000,000 passwords, it's going to take a while... ETA +30 days and the question is asked: Do the order of rules impact the cracking speed?
Yes and yes
a) The more cracked passwords, the greater your chance to see a pattern, leading to more passwords being recovered.
b) Due to the human nature, what would be more unlikely? Mr Dingbat appending and prefixing 5 or 2 digits?

Let's grep it and we'll find out!

Out of about 50% of the passwords cracked, the distribution indicates such patterns:

abc..00 593,914 hits , or   17% of the total
abc..0000        400,114               11.4%
abc..0           367,969               10.5%
abc..000          219,942                6.3%
0abc...              79,224                2.3%
down to ..
00000abc..          5,200                0.1%

Hence the logical order of trying 1,2,3,4,5,6 digit either after or before is not the most optimized and will take you longer. The proper order in that case would be:
(Warning slow stuff!!!)
$[0-9]$[0-9]
$[0-9]$[0-9]$[0-9]$[0-9]
$[0-9]
$[0-9]$[0-9]$[0-9]
^[0-9]
^[0-9]^[0-9]
$[0-9]$[0-9]$[0-9]$[0-9]$[0-9]^[0-9]
^[0-9]^[0-9]^[0-9]
^[0-9]^[0-9]^[0-9]^[0-9]^[0-9]
^[0-9]^[0-9]^[0-9]^[0-9]

Charset making

This section is specific to part 2) Bruteforcing Longer than 8ch long
Having modified params.h is a prerequisite, as described in 2)
You can always re-compile if you've missed it the first time.
Before doing it, we recommend that your John.pot has gain some "fat": crack few hashes

1) Open Terminal and go to your /John/run folder
1a) Run ./John --make-charset=[choose a name].chr

i.e ./John --make-charset=longforce.chr
hit return and wait for John to finish

2)   Open John.conf with TextWrangler
2a) Look for the section containing " # Incremental Modes"
2b) copy the part
[Incremental:All]
File = $JOHN/all.chr
MinLen = 1
MaxLen = 8
CharCount = 95

Paste below and change the parameters to match your hopes, example:
[Incremental:longforce]
File = $JOHN/longforce.chr
MinLen = 10
MaxLen = 15
CharCount = 95

"longforce" being the incremental name, "longforce.chr" the charset name, "MinLen" the Minimum paswd length tested , and MaxLen the max one.
Min/max 10-15 is already a stupid long keyspace, hence you can create as many section as you wish , i.e "longforce13" and only attempt to Bruteforce 13 long passwords
MinLen = 13
MaxLen = 13
( I would limit myself to a specific time frame, i.e a day or two.)
When ready, just run ./john --incremental=longforce13 [other useful parameters ....]
☞ You can always run one instance of John per Core. 4 Cores, 4 Instances. Each of them running a separate "bruteforcing" length i.e 10,11,12,13 ch long.
That should keep you busy for a while...

** Matt Weir
If you want the advice of a real specialist, you might want to read Matt Weir's blog
http://reusablesec.blogspot.com/
Matt has now left this earth... Well...no, he is still alive, he has just stopped blogging for professional reason. He's a bit like Obi-Wan Kenobi: not here anymore, but you can still feel The Force.
Just like Elvis, there have been some sightings! The last report of a Matt Weir sighting was at DEFCON2012. If you have experienced such, please report your findings immediately.
Matt Weir has also made some optimized (scientifically optimized, (It's Dr. Weir)) Config, you can read about it, and even download them:
Matt Weir's Pack o' Configs You M.U.S.T read the little "read me" in each file!
Optimizing john single mode
Follow up on single mode
Kore Logic Rules, Modified by Solar Designer himself (The Creator of JtR)
Theses are "rules" and not a "John.conf" with rules

Update, Sept '12
As soon as the article was done, The JtR Team made few improvements :)
- A GUI JtR was released for Linux
- A Newer pre-compiled Version of JtR Jumbo 1.7.9 was released too
Nevertheless, there is always a delay between the most recent JtR version and the JtR, Hence compile it yourself.

ALLA
(Another Linkedin Lame Analysis)

Fun Fact about the Linkedin dump

First Character usage, Most used first

ae1iInrosl0t2mdc3uh9kb748g5p6yjfvwzxASMLB!RCTEq@NDPGHKOJF$.#W*UV_Y-Z&XQ+%/?,=);(^':~["^<]>|{}

Hypothesis:
Even though the keyspace remains the same than an alphanumericaly sorted character set, a sorted by usage Charset should be slightly faster as more hash -should- be cracked earlier.
The analysis of the 1st to 6th characters distribution indicates almost a constant pattern.
Does anyone has a documented opinion? Anyone?

Distribution of first to sixth Ch.

Click To Enlarge

Character usage, Reversed
}{|>]<^"[~:'^(;)=,?/%+QX&Z-Y_VU*W#.$FJOKHGPDN@qETCR!BLMSAxzwvfjy6p5g847bk9hu3cdm2t0lsorniI1ea

Most "unlikely" password
}{|>]<^"[~:'^(;)=,?/%+QX&

The ones that are hard to find:

(fund 123) קרן 123
привет (Hello)
سعمفشى (Sultan)
قخنشغش (Rokaya)

Comments:
Please, if you leave a comment, let us know:
1) Your OS version
2) The JtR Version
3) Your machine type

Also, it's cd /john/src and not /john/src
cd as Change Directory

How to Crack a .DMG (Encrypted DMG file)

2012-08-31T13:11:00.000-04:00

John The Ripper : Cracking a .DMG

Let's cut to the chase right now:
Cracking encrypted disk image, AKA DMG is feasible, but, and there are many buts, is extremely, extremely time consuming.
If you do not remember at all the password, or if you attempt to crack in "blind mode", you will probably need to teach your kids how to do it: By the time you'll have a fighting chance, you'll be long dead.

Step 1: Write down everything you can remember about the forgotten password, i.e what you could have used, and what you are sure not to have used, i.e. never used a space or a "@" sign.

Step 1a: If you remember enough of your password, or if you are just missing trailing numbers i.e Mypassword???? >> MyPassword1234 and do not remember if it's 1234 or 4321, or 9999, Just use CrowbarDMG and a Wordlist.

For good Wordlists, go here!

If you need to create a specific wordlist (because you remember what you may have used and, most importantly, what you may have not used, go here and look for Wordlists On Demand)

Warning!: CrowbarDMG is slow!
CrowbarDMG is basically a GUI for the hdiutil command

ETA for trying 9999 passwords: About 3 hrs
                      99,999 passwords: About 30 hrs
999,999 passwords: About 300 hrs   Or 12 days ....

Step 2: Do you know how to compile and use John The Ripper? I mean "use it! including editing Rules, etc?

--> No?    Proceed here. Read carefully. Pause. Repeat.

--> Yes!   Ok, Sure?

1) Download JTR, version Bleeding Jumbo by Magnum
As of Aug 2013, it's here otherwise here

2) Compile. Don't forget to edit the Makefile and John.conf. Check for CUDA and OMP/MPI RUN. Creating a new Charset? that could be wise...

3) Run dmg2John.py to extract the hash
python [path to file ]dmg2john.py [path to file] myfile.dmg > dmg.txt

4) Edit/Create your rules as needed

5) ./ John etc        (Run Baby, run ....)

6) There is always Hashcat (Win/Lin)

7) Because most you have seen, in movies, Hackers cracking an AES within minutes, you'll try without thinking too much about it.
It's going to leave you with a lot of time to read ....
Enjoy ...

8) Without going into too much details, the use of GPU assisted is highly recommended. If you have one of those ones, you'll most likely increase your speed by a factor of 1000, sometimes 10,000 times faster.

☞ How big is 2^{128}?

☞ Password Cracking AES-256 DMGs and Epic Self-Pwnage
(The Keyword here is: 25 GPU)

☞ "If you have thought about a new cracking method, It's probably already in JtR"
(Matt Weir) (Quoted liberally)

☞ "I don't care if the NSA teams up with the KGB, a full random 15Ch long AES is practically unbreakable in a lifetime.
(Matt Weir, Quoted Very Liberally, From circa 2009)

EPAG: Empirical Poke-Around Graph
Markov Probabilities

Long Range WIFI

2011-11-11T08:50:00.370-05:00

Long Range WIFI

If you are the type to use your laptop within 3 inches of your router, this article is not for you. On the other hand, if you want a better connection anywhere in the house, or from house to house, or even for RV's, Boating, Camping, Trekking, then take a look: You are going to be surprised at what you can do for less than $50.

After reading this article, never complain again that you have a "bad connection" ;-)

So, before we start, Take a quick look a this ...

Do you see the dot on the left of the horizon?

This one....

How far is that? Would you like to make a wild guess?

Yes, That one ... on the detail

3km? 5km? 8km?????

Well...

That is 13.5 km away, or about 8.4 miles (44,352 ft)

And guess what? This is one of the "shortest" long range we've measured!

Now that we have your attention .....

We can put that in perspective ....

The red line on the right: The 2 points are 9.58 miles apart, or 15.4 km

To add a little to the bragging rights, this one is Out Of Line Of Sight and Out Of Fresnel Zone.

All data has been GPS/WiGle Verified.

All of that, with out of the shelf products, stating at $35.

Ready?

The specs:

Location

An fairly open location, on a hillside overlooking the city. Please note the trees on the left and right, and what you can not see: Hills on the left and right, and continuing behind us. This gave us a ~60deg opening, Not a 360.

Elevation 344ft (104m)

The leftmost target is the Prudential Tower, max absolute elevation 755ft (230m)

Top Of The Hub is the name of the restaurant ...on the top...

The rightmost target is Logan Int'l Airport, Altitude 13 ft (3.5m)

The Gear

When you reach those distances, size starts to matter but we remained into the "low tech"

We've made 2 tests, 7 days apart, and interchanged the material in order to avoid a NFTL moment (Neutrinos Faster Than Light) and tested up, down, left and right.

- All the Tech lingo and tips are at the end. Don't read it! Because if you do, you'll learn that using the wrong cable can cut your performances by a factor of 10.

GPS

A GPS for the position, verified as well with Google Earth and WiGle

The GPS is a USB GlobalSat, KisMAC compatible. And Waterproof ;-)

Antennas:

Alfa 5 dBi Dipole

Alfa 9 dBi Dipole

Cantenna (given for) 12dBi

Magnetic mount (for Dipole Antenna)

USB

regular USB and Active USB 16ft /5M

Cards

Alfa AWUS036H 1000mW 802.11 b/g (OSX 10.6)

Alfa AWUS036NH 2000mW 802.11 b/g/n (OSX 10.6)

Alfa AWUS036NHR 2000mW 802.11 b/g/n (OSX 10.7, 10.8)

Alfa Tube-U (G) (Waterproof) 500mW 802.11 b/g (OSX 10.6)

Test #1

Alfa AWUS036H + 5 dBi Antenna

We plugged the trusted Alfa AWUS036H and fired KisMAC, to our surprise, we got contacts!

the Alfa had a little 5 dBi antenna, and we were sitting on a table, with the wall in front of us: Far away from "Perfect Conditions" I would have never expected to get a signal with this configuration

The SNR was 21, hence not the best for a real link. Still: contact with no effort.

Test #2

Alfa AWUS036H + 9 dBi Antenna

As you can see, the antenna is a size up, but it's still an omnidirectional.

The number of contact point increased, as well as the SNR (Signal to Noise Ratio) (The higher the better) We got between 21 to 27 dB SNR with the 9dBi @ 13,500 m

A signal of 15-to 25 dB SNR would be about the equivalent of a "2 bar" : link is possible

Test #3

The Fresnel Zone dictates that, based on a set of complex and boring laws of physics, if you are close to the ground, it ain't going to work well. Hence, you need altitude....

Mr. Fresnel was right, proof is that you'll often find Telecommunication satellites in orbit, and rarely on the ground.

As we are immensely wealthy, have little imagination, and never recycle or reuse, and hate DYI, we came up with this Hyper-High-Tech-WIFI-Tower: An aluminum pole with some tape.

All you need after that are few nice assistants to hold the pole.

Thanks to the Wifettes for the help :-)

Then we got 3 contacts @ SNR 32dB. That's equivalent to 3 bar

One thing to mention: Distance= 15.4km / 9.8miles :-)))

The Card was on a USB ACTIVE extension, length 5m. Doing the same on Coaxial cable would have almost "ruined" the test. @ 5 meters and above, an Active USB is beginning to be mandatory.

Test #4

This time, we used a Cantenna, it's a directional Antenna, (beam ~30 degrees ) and attached to it , a Tube-U (G).

The Tube-U is an Outdoor Waterproof version of the Alfa AWUS036H. The difference resides mainly in N-Connector and the Waterproofing. The design is made to be used for the outside, On RV's , Boats, of simply left outside.

The N-Connector allows to plug bigger antenna or to use Coaxial cable.

I don't like Coaxial cables: They are expensive and generate losses of signal. You'd rather buy a 20meters long Active USB than a Low-Loss Coaxial. As for the Ultra-Low-Loss...pffff.

In this pic you see that we plugged the Tube-U directly to the Cantenna.

This Cantenna was purchased at a yard sale for $3. In my opinion, it's worth less.

After aiming at the target for a while, we got the following results:

As you can see , EnGenius 1-2-3 dropped from 32dB to 26.5dB

dB (decibel) are ....logarithmic. Going from 32dB to 26dB is a downgrade by a factor of 4.

We were not able to test the Tube-U with the 9dBi Dipole as the we were missing a Gozinta. (Connector. Please don't Google "Gozinta" ) So I can't blame the Cantenna for sure, but I'll keep an eye on it. In any case, I would not recommend a Cantenna: I can achieve the same result with a disposable aluminum pan, and the Cantenna size is only working for a specific frequency. You would need a different one on a 802.11 /n.

If you need a directional Antenna , go with a Flat Panel, a Yagi, or even better, a Parabolic.

As soon as I have the right connector, or the right antenna to fit the Tube-U, I'll post an update.

For you guys, I'll even try with the cover of my barbecue: I would not be surprised if it could beat the Cantenna.

WIFI 101 for Dummies, or how to extend your WIFI coverage

RF Radio Frequencies

Another very simple subject...

A WIFI is basically a two way radio adapted for computers.

That was the "Radio" part. Now comes "Frequencies"

2.4 GHz or 5GHz?

Well, 5GHz of course, because the higher the better, no?

- Nope!

- It's a trade off between speed and distance: The lowest the frequency, the greater the distance. The higher the frequency, the greater the amount of information you can carry (speed), but the lower the distance.

When you put that into numbers, the results are the following:

For a theoretical setting using the same parameters, Theoretical Distance Achievable:

1220 MHz 30,800 m

2440 MHz 15,400 m

5000 MHz 7,500 m

Channels

The 2.4 GHz /g band has 14 channels, 22 MHz wide, each separated by 5MHz, but Ch14 who is separated by 12MHz.

Wait! that's not possible! only if they overlap!

Yes, they do overlap. A little drawing will help ...

Only Ch 1, 6 and 11 do not overlap, that's why they are less likely to have "noise" or "pollution" But as they the most used, well.... they can be "noisy"

When 10 of your neighbors are using the same #6 channel, it's a bit like have 10 people having a -different- conversation in the same room: The noise pollution increases and you start to have issues hearing correctly.

Fresnel Zone

The Fresnel Zone dictates that, based on a set of complex and boring laws of physics, if you are close to the ground, it ain't going to work well. Hence, you need altitude.... and Mr. Fresnel was right, proof is that you'll often find Telecommunication satellites in orbit, and rarely on the ground.

One of the best way to clarify the Fresnel Zone is for you to imagine that your WIFI, both transmitter (Tx) and receiver (Rx) are light bulbs: If too close to the ground or next to an obstacle, the light is going to rebound or being absorbed.

The further away, the greater the height (altitude) is needed for a good Tx & Rx.

Source unknown

Power

dBm for Dummies:

dBm ( decibels relative to isotropic radiator) is the gain of an antenna. It is also logarithmic. Hence a gain of 3dBm is equivalent to doubling the power, 6dBm quadrupling it, as well, it is also valid for a loss: 3dBm loss and you lose 50%.

The power of a device and its antenna are nowadays often expressed in mW (milliwatts) This purpose is purely marketing oriented: claiming a gain from 33dBm to 36dBm does not have the same "marketing impact" as saying 1000mW to 2000mW.

Please note that you have to add the antenna gain to those values.

The legal limit values are theoretically including the antenna gain

36 dBm 4.00 Watts <-- Maximum EIRP* allowed by FCC in U.S.
33 dBm 2.00 Watts <-- Tx Alfa AWUS036NHR and AWUS036NH

30 dBm 1.00 Watts <-- Tx Alfa AWUS036H 1000mW version

27 dBm 500 mW <-- Tx Alfa AWUS036H 500mW version

26 dBm     400 mW
25 dBm     320 mW
21 dBm     130 mW
20 dBm     100 mW        <-- Maximum EIRP* allowed by E.T.S.I. In Europe.

Apple Airport Extreme Nominal Output

15 dBm 32 mW

10 dBm     10 mW
1 dBm       1.3 mW
0 dBm       1.0 mW
-1 dBm      0.8 mW
-10 dBm    0.1 mW
-20 dBm    0.01 mW
-40 dBm    0.0001 mW
-60 dBm    0.000001 mW
-70 dBm    0.0000001 mW
-80 dBm    0.00000001 mW        <-- Receive threshold for most WLAN devices

-91 dBm 0.00000000080 mW <-- Min Rx Alfa AWUS036H

-92 dBm 0.00000000063 mW <-- Min Rx Alfa AWUS036NH

-96 dBm 0.00000000025 mW <-- Min Rx Alfa AWUS036NHR

* EIRP = Effective Isotropic Radiated Power

Hence, as per the specs, an Alfa AWUS036NHR / AWUS036NH has up to 20x times the transmit power of an Apple Airport Extreme, the Alfa AWUS036H up to 10x times.

The sensitivity of both the H, NH and NHR are really impressive

For the sensitivity, (Rx) the lower the dBm, the better.

WIFI Distance Calculator

http://www.afar.net/rf-link-budget-calculator/

http://www.afar.net/fresnel-zone-calculator/

Rainbow Tables

2011-11-06T10:50:00.000-05:00

READ THIS:
As of June 9, 2016 we are no longer accepting Paypal
We will update this page and change the payment methods.
if you have any question, drop us an email at kismac.x at gmail dot com

Thank you for you patience.

Rainbow Tables / Precomputed Tables
Rainbow Tables are precomputed tables that allow you to attempt to crack a WPA key at Astonishing Speed:

39,847,344 PMK/ Second (Pairwise Master Key)

Pyrit-CUDA + Precomputed Tables       39,847,344 PMKs/S (Instant Reading)
Pyrit-CUDA + Precomputed Tables         1,576,213 PMKs/S (Averaged)
Pyrit-CUDA                                                    ~ 2,700 PMKs/S
Aircrack-ng 1.1           ~ 1,500 PMKs/S
KisMAC 0.3.3                                                   ~ 600 PMKs/S

In Short:
What I do in 10 sec with Precomputed tables, you'll it do in 18 hours on Aircrack-ng and 40 hours on KisMAC, Or about 2.75 million % Faster than Aircrack-ng

Precomputed Tables, Rainbow Tables, Space-Time Trade Off : FYI, It's the same thing!

Why Rainbow Tables?
Rainbow Tables are "pre-chewed" Pairwise Master Key (4096 Rounds of SHA-1 per PSWD), hence you just have to "compare" Vs. recalculating everything, everytime, for each password tested.
The example above shows a speed of almost 40 millions Pairwise Master Keys per Second
In simple terms, this is 2.5 millions times faster than KisMAC.

With the Precomputed Rainbow Tables & Pyrit you can:
- Crack a WPA at least 110,000% faster than with Aircrack-ng
- Add Passwords to an existing Table without having to re-compute the entire database of Precomputed PMKs
- Add or Delete ESSID's in few seconds
- Import unique passwords, ensuring no duplicates
- Create your own and add new passwords
- Re-compute newly added SSID's or Passwords without re-computing everything.

Premium Pyrit CUDA Precomputed WPA Tables

What's included?
- A Set of Precomputed Tables ~16,000,000 Passwords From the Master Passwords Attack Dictionary precomputed for the most used 10 SSIDs, That's about 3.5 GB of data ( We have a limit on how much we can put on Dropbox and how much you can download per day)

Premium Pyrit CUDA precomputed Tables: ~~$ 24.99~~ $14.99

Premium Pyrit Rainbow Table + Crackium Suite
- All of the above plus the Crackium Suite
- about 1 billion passwords, and the ways to turn that into 400 billions if you want to.
A $38 value for $24.99

Includes:

A "How-To" to expand , modify and tweak your Wordlists

Monster Dictionary, a statistical compilation of 50+ passwords heist: 220M passwords
Monster lite, for WPA, John The Ripper, Aircrack, KisMAC, HashCat and Crowbar
MasterPasswords Version 7.99 ~25 millions real passwords, plus variations of the most used.
All numbers 8ch long 100,000,000 Pwsd.
Ilove.txt over 1 million most used first name with 22 permutations of “I love you” i.e iluv, ILove, etc 25,523,113 Pwsd
A full set of signs !@#$%^&* , 8 ch long , 214,358,888 passwords
A full set of SSN # 000-00-0000 to 099-99-9999, modifiable: 100,000,000 Pwsd.
A set of most used First names, sorted by occurrence (most used first) 4,347,600 Pwsd
A set of most used Last names, sorted by occurrence (most used first) 5,369,400 Pwsd
A set of the most used Fnames and Lnames, formatted lower, Proper, UPPER.
A full set of phone numbers, pre-made to easily create your own list in minutes: 1 Format (XXX) 00-0000 to (XXX) 99-9999 8,960,000 Pwsd + 1 Format XXX 00-0000 to XXX 99-9999 8,960,000 Pwsd + 1 file with all phone numbers, all areas for NY (NYPH.txt) 116,480,011 Pwsd, modifiable to all areas.

With the How-To PDF, you can create all formats needed with all correct prefixes for your area.
Note: This is 2 different downloads, one download for the Precomputed Tables, One Download for the Crakium Suite.

Why use Precomputed Tables?
Bruteforcing a WPA is a long process: Each time you perform an attack you re-compute the same pairwise mater keys over and over again; in simple terms, you rebuild the entire house each time you ring the bell.
Attacking WPA by brute-force is pushing the equivalent 1 megabyte of data per PMK trough the CPU.
1500 PMKs/second is equivalent of hashing 1,572,864,000 bytes per seconds. And you wondered why the CPU was churning @ 100% capacity? That's 1.46 GB per second.... on a DualCore...
With Precomputed Tables, all the tedious work has been done before, now you're feeding "pure" pre-hashed data... that's like Turbo Warp Mode: 10 Seconds to go trough 15 million passwords instead of 18 hrs.
An UberGeek has linked 16 GeForce 8800 GT and reached about 749 Gigabit of data processed every second. The speed on non-precomputed tables ("regular crack") was 89,300PMK/S, hence we can estimate a speed of about 100,000,000 PMKs/s on precomputed tables

FAQ & RFAQ

Cracking Speed Achievable (Sustained & Averaged)
- Dual Core 2.5 GhZ + Nvidia GeForce 8600M GT + Precomputed Tables
1,500,000 PMKs/S    ( about 110000% faster than Aircrack )
- Quad Core 2.5 GhZ + Nvidia GeForce GeForce GT 330M + Precomputed Tables
2,750,000 PMKs/S

Cracking Speed Achievable (Instant Reading)
- Dual Core 2.5 GhZ + Nvidia GeForce 8600M GT + Precomputed Tables
39,847,344 PMKs/S ( about 2,500,000% faster than Aircrack )
- Quad Core 2.5 GhZ + Nvidia GeForce GeForce GT 330M + Precomputed Tables
53,662,947 PMKs/S

You NEED Pyrit or Pyrit-CUDA to achieve those speeds, You can install Pyrit (free) as explained here: http://easymactips.blogspot.com/2011/07/how-to-install-pyrit-cuda-on-mac.html

Pyrit-CUDA will consume 100% of your resources, don't attempt to surf the web or play a game while running Pyrit-CUDA, Nevertheless: As the running speed of Pyrit CUDA on Precomputed Tables is so short, you should not have to wait more than 5 minutes for an answer.

Alfa Drivers For Mac

2011-11-01T12:49:00.000-04:00

Alfa AWUS036H

Pro:
- The 036H is an excellent card, great sensitivity with a great power.
- Can be also used with KisMAC from OSX 10.5 to OSX 10.8. Please not that you'll need KisMAC R407 to use it on 64 bit.
- Multi Antenna
- Can capture a signal at up to 15km
Con:
- The Realtek Driver is no longer supported after 10.6.8

A test/benchmark of this card is available here, including test on long range WIFI.

Mac Drivers Download for the Alfa AWUS036H

15km / 9.4 miles Alfa 036H + 9 dbi antenna

KisMAC and OS X Lion 10.7, The Solution

2011-07-24T08:00:00.009-04:00

KisMAC and OS X Lion 10.7, The Solution
How To make KisMAC Work under OS X Lion

Update August 2012

KisMAC Trunk r407 has been released
This trunk fixes some of the issues with Lion 10.7+ and 10.8
Airport Passive Mode is still not working but you may/can use an USB adapter with it (WLAN)
this is a temporary fix and you use KisMAC r407 at your own risk(s)
Please report to Kismac-ng for any other info.
If you still need/want to use your Alfa 036h/Realtek without KisMAC, then keep on reading...

Apple has changed the API again, hence there will be a flotation time until KisMAC is truly updated for Lion. In the mean time, if you have tried, you'll have probably noticed a freeze under Passive mode.
Here is a solution to make KisMAC work under Lion without too much fuss.
Before we go in highly technical details, you can give us some luv on FB... yes, you can ...

So, to make it work, you'll need either some serious Terminal capabilities or the Kali App.
The (a) second solution, is to create a bootable USB as explained here: You have paid for Snow Leopard, keeping a bootable copy on hand can be very useful , i.e you crash your Lion HDD and need to get some files or make a fix. or use KisMAC ...

WARNING!
Do NOT install the Drivers of the card (Realtek.app) unless you have the Kali App.
If you install without Kali App, the drivers will prevent KisMAC to be able to load its own.

Kali App.

*WLAN: also know as USB cards, etc. DO NOT buy any type or you'll be sorry. You NEED a specific one. The best one is here
Also, as a warning: eBay is full of knock off of this card, they look the same, but if you get one shipped "from the US by a Chinese vendor in HK" You will be sorry. By experience, I only recommend a few handful of vendors. Why? Because I can connect one mile away. Yes, that's 1,6 km.
You can also use the card as a second wifi, the signal compared to Airport is about 60% better. Just that, it makes worth every cents of it.

Comments, The New Rules:
- Don't use "Anonymous" use "name/url" instead. Even a fake name one will do. If If you insist on using anonymous, you'll get a "Who are you?" for sole answer.
- Check this page before asking!
- If your question has been asked before, it's probably answered. if it has been answered before, you'll get the link above a second time. If you do not wish to read or need personalized help, check the donate page or the KisMAC School.

.

How To Install Alfa AWUS036 NHR on Mac OS Lion 10.7

2011-07-24T07:21:00.004-04:00

Alfa AWUS036 NHR Drivers for Mac OSX 10.7

This is going to be a very short post.....

Very simple...
Extremely simple ...

How To Install Alfa AWUS036NHR on Mac OS Lion 10.7?

Like that:

Alfa AWUS036NHR Mac Drivers For Lion 10.7

Voila!

That was easy, huh?

Now something more important:
The Realtek Uninstaller provided with this package does not close "sudo" after use. As per Apple Dev. this could leave a security hole. Close sudo by opening terminal and type "sudo -k". -Without quotes, you silly!

.

How To Install Pyrit CUDA on Mac

2011-07-24T06:36:00.004-04:00

Pyrit CUDA: Release the Kraken!

How To Install Pyrit CUDA on a Mac

We hope that you have not landed here randomly, Pyrit CUDA is not for the faint of heart, But your patience will be rewarded. Highly rewarded.

CUDA stands for Compute Unified Device Architecture. It uses or unleash the power of your GPU(s) to compute a bit faster things like .... WPA key Recovery.
Pyrit CUDA is not a magic bullet, it's just a much, much bigger caliber.

Why Pyrit CUDA?
On my "Old MBP", Pyrit CUDA is 45% faster than Aircrack-ng without a sweat, If you have a "New Mac" with a much faster Graphic Card, you can expect 50-200% faster.
45% means than instead of running for 10hrs, you'll do the job in 5.5hrs, Some monsters claim 89,000 PMKs/S. With a little tweak, you can go 300% faster, see example under "tips"

Pyrit also allows you to create database of pre-computed PMKs, also known as Rainbow Tables, and here, it starts to go really really really fast ...

Engage Warp Speed and Release The Kraken...

There you have it!

39,847,344 PMKs per second....
27,481 times faster than Aircrack-ng, or a 2,747,993% increase in speed
Yes, that's almost 2.75 million %
It simply means that, what you do in 18 hours, I'll do in about 10 seconds :)

Pyrit Precomputed Tables are here.

Back to the install ...

I went to Pyrit after finagling wayyyyy to much with Aircrack-CUDA. Using Backtrack5 on VMware, Aircrack-CUDA was the straw that broke the camel back: The time needed for the install and fixing the issues was longer than trying Aircrack the regular way. So, here is Pyrit, native on a Mac.
Pyrit also allows you to create database of pre-computed PMK, also known as Rainbow Tables, and here, it starts to go really fast ...

How To Install Pyrit CUDA on a Mac, OSX 10.6.8
For OSX 10.7 Lion, almost the same, but read the help first

Prerequisite
Xcode must be installed!
To check, Open Terminal and type "gcc"
If the answer is as described below, you have Xcode installed. If Not, >> App Store >> Xcode (free)

10.8 Mountain Lion
Apple has, by default, removed the CLT, For Mountain Lion you must install the Command Line Tools
Preferences -> Downloads -> Install command line tools

1)    Click  > About this Mac > More Info > Graphics/Display to check your Card model #
1a) Verify that you have a CUDA supported graphic card, if not, you are good for trying Open CL
2)     Follow the steps exactly in the order they are mentioned.
3)     You need to have Admin Rights or the Admin Password
4)     You should be Terminal Savvy. If not read the tips at the end first
5)     You need to type the commands verbatim. A space too much and you're out ....
6)     You can click on the pictures to enlarge them. It could help....
7)     There is a list of warnings at the end, read them!
8)     Verify that you have verified the verifications

The full install takes about 30~45 min.

Ready?

Download, in a easily accessible folder the following , do NOT install yet

Nvidia CUDA drivers for Mac:
http://developer.nvidia.com/cuda/cuda-downloads

Download 1 and 2

Select "CUDA Toolkit" under Mac OS For Older Version (10.6.6 and under)

NOTE:
If you have an "old" Nvidia card, try the "older version" first, you'll save a lot a space.
the "old version" is half the size of the new one, and you can always upgrade later

Libnet
http://libdnet.googlecode.com/files/libdnet-1.12.tgz
pylibpcap
http://dfn.dl.sourceforge.net/sourceforge/pylibpcap/pylibpcap-0.6.2.tar.gz
Scapy
http://www.secdev.org/projects/scapy/files/scapy-latest.tar.gz

You should now, have something looking like that:

Install Nvidia Driver for Mac
Click on the DMG, etc ..

This install is going to take few minutes..

Install Nvidia CUDA TOOLKIT for Mac
Click on the DMG, etc

Install Nvidia CUDA drivers for Mac
Click on the DMG, install, etc
i.e: cudadriver-5.0.17-macos.dmg

Open Terminal and start the installation of libnet
"Path to" refers to the path to the file. i.e /Users/MyName/Downloads/
Example:
-->

tar -xzf /Users/MyName/Downloads/libdnet-1.12.tgz

Instead of typing the full path by hand, drag and drop the file into Terminal, that will save you some typing and errors

Install
-->

tar -xzf “Path to” libdnet-1.12.tgz
cd libdnet-1.12
./configure
make
sudo make install
cd python
sudo python setup.py install

Now we install Pylibpcap
-->

tar -xzf “Path to” pylibpcap-0.6.2.tar.gz
cd pylibpcap-0.6.2
sudo python setup.py install

Scapy Install
-->

tar -xzf "Path to" scapy-latest.tar.gz
cd scapy-2.1.0
sudo python setup.py install

* double check the "scapy latest" and scapy2.1.0 the names may have changed.

Now the prerequisites are done, we can go in the hearth of the subject.
From the Terminal Window, Download Pyrit
-->

svn checkout http://pyrit.googlecode.com/svn/trunk/ pyrit-read-only

Build and install Pyrit
-->

cd pyrit-read-only
cd pyrit
sudo python setup.py install

Last step, Pyrit CUDA
-->

cd ..
cd ..
cd pyrit-read-only
cd cpyrit_cuda
sudo LDFLAGS=-L/usr/local/cuda/lib python setup.py install

* cpyrit not "pyrit" cd cpyrit_cuda

Now we need to check if all of that was worth it
Check if Pyrit CUDA is working
-->

pyrit list_cores

You should see a list of your cores and a list of your GPU(s)
Something like

Once done, let's Benchmark it and see if we can Release The Kraken
-->

pyrit benchmark

(Recommended) Kill SUDO by typing sudo -K (yes, uppercase K )

*I have installed Pyrit on an old machine, the "good ones" are "reserved" for work. :-)
Leave a comment either here or on FB with your Config and the Benchmark Results.
Who has a monster?

GTK, FAQ, RFAQ, TIPS, Help

GTK! AKA "Good To Know"

Bruteforcing is time consuming, so you need to go as fast as possible, and also AS SMART AS POSSIBLE: Bruteforcing in blind mode, aka starting @ "00000000" and going all the way up, trying each alphanumerical combination is just a pure waste of your (limited) time, you silly mortal, and your electricity bill will go up a bit. Go smart, use a statistically sorted Attack Dictionary: Most used password first: If the password to discover is "password" running an incremental attack will take you few months: The first set of numbers is 100,000,000 long, then for each set of letters, add 110,075,314,176. You have 24 sets, hence 2,641,807,540,224 passwords. Then repeat with upper cap... then mingle all of that ... a0a0a0a0
Your brain has now stopped perceiving the true value of those numbers. Mine too.
But that's not it!
Mr. WPA is a tedious little man: Each password has 4096 round of hash, salted with the BSSID. It means in clear that your CPU/GPU will crunch about 1 Megabytes (byte, not bit) of data for each PMK (Pairwise Master Key) , Each Password is "about" 4 PMK
2500 PMK/second and you'll have 2.44 Gigabytes of data being pushed trough per second...
The first set of numbers, 8ch long, will boils down to about a billion megabytes of data being crunched.
So, Act like a ninja, and think like Einstein: Go smart!

Tips

If you are here, you should know it: Don't play too much with the sudo command: it's an unforgiving command. sudo does not give any warning, sudo is "Das Terminator"
Long paths
Avoid typing long path with spaces or weird names:
1) Download in a easily accessible folder
2) Type your command, i.e "tar -xzf" then drag the file from Finder to Terminal; the path will automagically appears correctly.
3) Use the arrow up to call back a previous command
4) copy and paste the command instead of re-typing them:
"cd cpyrit" just looks like "cd pyrit" ( "C"pyrit )
(The first one that will comment about cd not working will get seriously flamed)

CUDA use
When using Pyrit CUDA, quit all applications, including Anti-virus, Browser etc, I mean everything: Dropbox, Airport, etc. Anything that use a single %. Kill all processes but the vital ones: The performances will improve significantly.
For the best results, don't even use a screen saver: quit everything and let the screen go black. Remember? CUDA is using your GPUs. Following those tips you'll see the performance increasing significantly:

We are now 279% (Two-hundred-seventy-nine ) faster than Aircrack-ng 1.1 and 600% faster than KisMAC 0.3.3 . Yes, 600%. But, that's not it! Can you go faster than that?

Temperature:
If you crunch for hours, don't forget that Pyrit CUDA will try to use 100% of your CPUs and 100% of your GPUs: The Temperature is going to go up a bit. If you have a laptop, I'll suggest to elevate it on the four corners and leave at least 1/2 inch of free space under.

FAQ, RFAQ, SFQRFA

- My card is not supported!
Bummer! check OpenCL
- How do you crack a WEP on Pyrit?
You don't! Pyrit is WPA only.
- kan't crack the pazwords!
Probable Cause
- it doz not workz!
Probable Cause
- It's not working on Windows
Did you pass the test? (successfully?)
- I want to crack my girlfriend password
Talk to those guys
- I overclocked my GPU and my computer shut down
Told ya! Try not to go over 200F / 93C. If you insist, you may be able to fry an egg on your Mac, please send us the picture. For a "runny-sunny side up" you can start at 66C.
- Please help
It's just below. on more line...

Pyrit help
For more help type "pyrit -h [command]" i.e "pyrit -h attack_ passtrough"

Highly recommended reading:
http://pyrit.wordpress.com/
About Pyrit
http://pyrit.wordpress.com/about/

Pyrit on OSX Lion 10.7
"Many people have problems compiling Pyrit on OSX Lion. The version of GCC distributed with the latest XCode no longer supports creating binary code for the PPC-architecture and Python’s setup.py does not know about that; you can get an error message like the following:"

assembler (/usr/bin/../libexec/gcc/darwin/ppc/as or /usr/bin/../local/libexec/gcc/darwin/ppc/as) for architecture ppc not installed

You can solve this situation by forcing GCC to only compile code for the i386- and the x86_64-architecture. To do this, put the following into your .bash_profile:

export ARCHFLAGS=”-arch i386 –arch x86_64”

Source: http://pyrit.wordpress.com/
Retrieved Aug 2, 2011

Pyrit Mountain Lion 10.8 + MBP Retina

Pyrit CUDA_ERROR_OUT_OF_MEMORY
This Error seems specific to MBP's Retina and is easily solved by a single click.

Click To Enlarge

1) Open System Preference
2) Go to Energy Saver
3) box "Automatic Graphics Switching"
4) Uncheck the tick box

Many Thanks to Xander Clark for solving the issue and sharing with us.
Ditto to Christian T. for "Distant Lending" us his Beloved MBP Retina while vacationing in Greece. ;)

Pyrit 0.4.1-dev (svn r308) (C) 2008-2011 Lukas Lueg http://pyrit.googlecode.com
This code is distributed under the GNU General Public License v3+

Usage: pyrit [options] command

Recognized options:
-b               : Filters AccessPoint by BSSID
-e               : Filters AccessPoint by ESSID
-h               : Print help for a certain command
-i               : Filename for input ('-' is stdin)
-o               : Filename for output ('-' is stdout)
-r               : Packet capture source in pcap-format
-u               : URL of the storage-system to use
--all-handshakes : Use all handshakes instead of the best one

Recognized commands:
analyze                 : Analyze a packet-capture file
attack_batch            : Attack a handshake with PMKs/passwords from the db
attack_cowpatty         : Attack a handshake with PMKs from a cowpatty-file
attack_db               : Attack a handshake with PMKs from the db
attack_passthrough      : Attack a handshake with passwords from a file
batch                   : Batchprocess the database
benchmark               : Determine performance of available cores
benchmark_long          : Longer and more accurate version of benchmark (~10 minutes)
check_db                : Check the database for errors
create_essid            : Create a new ESSID
delete_essid            : Delete a ESSID from the database
eval                    : Count the available passwords and matching results
export_cowpatty         : Export results to a new cowpatty file
export_hashdb           : Export results to an airolib database
export_passwords        : Export passwords to a file
help                    : Print general help
import_passwords        : Import passwords from a file-like source
import_unique_passwords : Import unique passwords from a file-like source
list_cores              : List available cores
list_essids             : List all ESSIDs but don't count matching results
passthrough             : Compute PMKs and write results to a file
relay                   : Relay a storage-url via RPC
selftest                : Test hardware to ensure it computes correct results
serve                   : Serve local hardware to other Pyrit clients
strip                   : Strip packet-capture files to the relevant packets
stripLive               : Capture relevant packets from a live capture-source
verify                  : Verify 10% of the results by recomputation

More help
http://code.google.com/p/pyrit/

Basic Command lines
-->

pyrit -h attack_passthrough

The -h option gives a more detailed help on an option, here help on "Attack_Passthrough" -h should be used profusely.

-->

pyrit benchmark

Does a Quick Benchmark

-->

pyrit benchmark_long

Does a long Benchmark

-->

pyrit -r test.pcap -b 00:de:ad:be:ef:00 -i words attack_passthrough

Regular attack on a specific ESSID via Dictionary

-->

pyrit -r test.pcap -b 00:de:ad:c0:de:00 -o passwd.txt attack_batch

"Pairwise Master Keys that have been computed and stored in the
database previously are taken from there; all other passwords are
translated into their respective Pairwise Master Keys and added to
the database for later re-use. ESSIDs are created automatically in
the database if necessary."
Note: .PCAP, .CAP or Dumplogs are the same

Overclocking
You can overclock, but:
As much as you will be tempted, let me remind you that if you have a laptop, things may get hot. Really hot! Even SMCFan Control may not be enough.
Frying your GPU will not be a good thing. Overclock at your own risk(s) : Pyrit does not have a GPU watchdog

Little hidden gem:
because you've read so far, you deserve a little bonus:
Release the Kraken !

Comments:
Please read this before commenting

.

.

Alfa AWUH036H On Lion 10.7 and Snow Leopard 10.6.8

2011-07-01T18:57:00.017-04:00

The Page has moved : Please follow that link!

Alfa AWUH036H On Lion 10.7 and Snow Leopard 10.6.8
- Yes, it works .... both on 10.6.8 and 10.7

It works both ways: KisMAC on OSX Lion and Realtek Utility App (Alfa) both on the same machine

Click to enlarge

&lt;p&gt;&amp;amp;amp;amp;lt;p&amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;lt;p&amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;br&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;amp;amp;amp;amp;gt;&amp;amp;amp;amp;lt;/p&amp;amp;amp;amp;gt;&lt;/p&gt;

The Kraken has been released!

2011-07-01T10:33:00.009-04:00

The Kraken has been released!

Huh?

Yup, Liam Neeson will have to live in shame for the rest of his life, but besides that...

1,576,213 PMKs per second

What about it? well, on the exact same machine, with the exact same files ... Aircrack-ng 1.1 is at 1,425 PMK/S
We have here sustained 110,611% faster than Aircrack-ng.
Not 110.611 We mean 110,611.44% exactly
The MasterPassword file V7, ~25M passwords was run under 10 seconds instead of 18 hours.

Second test on a faster machine:
We're going to reach Warp Speed...

39,847,344 PMKs per second....
27,481 times faster than Aircrack-ng, or a 2,747,993% increase in speed.
Yes, that's almost 2.75 million %
Mr Scott, Engage Warp Speed ....

How To:
1) Install Pyrit CUDA or Pyrit Open CL
2) Get the Precomputed Tables
3) Crack faster than Warp Speed!

.

Best WIFI cards / Best USB adapter KisMAC Compatible

2011-06-14T23:30:00.004-04:00

Best WIFI cards /Wlan KisMAC Compatible

Also know as: KisMAC Network Adapters, USB Injector, USB NIC (Network Interface Card) or Kismac USB Re-Injection Adapters

Not all USB Network Adapters are created equal. If you have read some of the comments left, you have realized that buying the right "USB Thingy" will make your life a breeze Vs. a freakin' nightmare.

Some Networks Adapters will work, some may work in the future, and some will never work.
For the "Never" and "In a Distant Future" I will not spend too much time: For the sake of you, don't try to finagle or to save $5, you'll end up in a nightmare: Been there, Done that.

For the Adapters that work right away, we have 3 types: The Bad, the Ok , and The Excellent.
If you believe that an higher price will determine The Excellent, you're in for a big surprise!
So, enough suspense, here it is:

Best WiFi Card compatible with KisMAC
International buyers: See Below

Alfa AWUS036H + 5dBi + Mount + FREE SHIPPING   Compatible Mac / Windows / Linux / Ubuntu      Card + USB + Antenna 5dBi + CD + Mount
Alfa AWUS036H V5 1000mW    Compatible Mac / Windows / Linux / Ubuntu
Card + USB + Antenna 5dBi + CD is about $29

The Best Deal is: Same as above + 9 dBi Antenna (One 5dBi + One 9dBi) + Suction Mount Cup Alfa AWUS036H V5 1000mW + 5 dBi + 9 dBi + Suction Cup Mount + USB + CD
Price about $35 for the bundle. Mount alone is ~$4, 9dBI antenna alone ~$9

CANADA: Amazon.ca
GERMANY Amazon.de
UK           Amazon.uk          Without Mount Dock    With Mount Dock

This Ref only. The Alfa AWUS036NH (2000mW) is not KisMAC compatible. All Drivers for the AWUS036H , KisMAC compatible are located here. Windows, Mac, Linux included.

Here is an example on how good is that card:
( Click on Read More )

Hawking HWUG1 Vs. Alfa AWUS036H

3,546 ft with the Alpha and a simple 5dBi Antenna
Click to enlarge pictures.
Hawking: 6 Networks, Alfa: 54 Networks

GPS Verified.
Google Earth KML file
Click to Download, open with Google Earth

Make your choice: Best deals on this side of the universe

Benchmarks

Let's start with your Airport Extreme Card as a Benchmark.

All benchmarks were done from the EXACT same spot, with KisMAC running for 2 minutes.
To test the antennas, I have interchanged them (I have few of them, from 2dB dipole to 12dB Yagi)

Airport Extreme
Unless you have the curiosity, you may not have noticed that the more expensive MacBook Pro have a lesser sensitivity that the cheaper MacBook. The reason? Plastic Vs. Aluminum: The body of the MacBook Pro, being in aluminum absorb some of the RF, hence a lesser sensitivity. You would expect a better sensitivity for the price paid, but no!
Verdict:
Grade 3/10    Airport Extreme on a MBP Alu Unibody: (Card Broadcom BCM43xx)
Grade 5/10    Airport Extreme on a MacBook

USB Stick Hawking HWUG1

The HWUG1 has few advantages: Fairly small* and it comes with a RP-SMA connector for the antenna. The Antenna that is sold with it is a dipole 2.2 dB gain. Don't expect much from the antenna.
I am going to give you straight out from the website, a pure copy of their own words" ....Removable antenna with reverse SMA connector - upgradeable to a higher power antenna for a wider wireless coverage. (For the best result, pair the HWUG1 with a Hawking Hi-Gain Antenna )"
In short, they tell you right away and in so many words: buy a high gain antenna. From us, Please.Well, at about $40, one would expect not to have to shell out another $40 (Ebay, from $25+SH to $135) for a better antenna to get some signals.

I am not impressed by it's sensitivity, nor by it's price. (in relation to the quality)

Verdict : Just OK. Grade 5/10

Hawking HWUG1 Specs:
Receive Sensitivity -70dBm@54Mbps, -83dBm@11Mbps
Transmit power 17dBm ± 2dBm (about 50mW)
hawking hwug1 Chipset: RT73 FCC ID#: NDD957318S607

USB Stick Hawking HWUG1A

Ah! This one is "Mac Compatible", White, and $10 more than the grey one. A quick look will reveal to us that the FCC ID# is identical to the HWUG1: hence same Chipset. Roughly, it's white and $10 more.
As for the sensitivity, well, as it is the same Chipset (RT73).... I can't see any difference. (but I am just a user, not a lab tech.)

Grade 4/10 but hey! it's white!!!! And between $50 to $60

Hawking HWUG1A Specs:
Receive Sensitivity -70dBm@54Mbps, -83dBm@11Mbps
Transmit power 17dBm ± 2dBm (about 50mW)

Hawking hwug1 Chipset: RT73 FCC ID#: NDD957318S607

Edimax EW-7318USg

Okey... look like an Hawking. Or the Hawking look like an Edimax.
Chipset? identical (RT73)
FCC ID? Identical: NDD957318S607.
So, when it looks like a duck, walks like a duck, and quack like a duck, it's probably a duck.
The result are almost-almost the same, the antenna delivered is a "high gain" 4dB, but my test are giving me the exact same result as with a 2.2dB, and a 5dB. So, I frown and wonder.....
Price is the same, or more .... from $35 to $73 (!!!!)
Verdict: Just Ok at $35, very bad at $73.

Grade 5/10 at $35 , 2/10 at $73

* All USB sticks have a little issue: they are a bit "fat!". Once you plug them, the width of the stick does not allow you to use the next USB port. For that, you'll need a USB extension.
* in any case, you better use a USB extension than a Coaxial Cable Extension: The longer the Coax cable, the more loss of signal.

Who's Your Daddy?

Not the good, but the Excellent!

Warning: Copies and knock-off of this Card are rampant on the internet. They look the same, but you're in for a big disappointment and a lot of swearing if you don't make sure.

First, your average USB stick has a transmit power of 40 to 70mW, this one has 16 times more, and 25 times more than a D-link 122 ( Built-in antenna are baaaaaaad)
The Chipset (engine) works right off KisMAC. Plug and Play ....
Compatible Mac, Windows and Linux (and it's not just white!) , RP-SMA Jack for Add-On antennas, USB Extension is provided.

Sensitivity:

The sensitivity is remarkable, at first try I got 42 AP's compared to the 2 that I had with my Airport and the 9 with the Hawking, respectively 2,100% and 466% increase.

Second try:

I was so surprised that I had to double check:
Some SSID were named after the owner, i.e "Jane Doe's Network". As I live in the 'burbs, it's not really hard to figure out where the owner is compared to me: "Jane Doe" on the White Pages + Google Earth and the Ruler tool gives you the distance.
So, "Jane Doe's Network" was ....1750 Feet away! 536 Meters
Okeyy... Where I am , it's the suburbs. Fairly flat but not "clear of obstacle" houses, trees, etc.

My first thought was: something is wrong. 1750 Feet with no directional antenna was too much. The signal was faint, but it was there...
I took note of the BSSID i.e 00:24:A0:F8.... and take the car for a little wardriving... go to the address and ...
Bang! Confirmed ! It was not an error. 1750 Feet
On the way back, I locked on MY SSID, and drove around. I went to a mount with a fairly clear line to my AP, and started scanning... Connection established... downloading emails 1900 feet away from my AP.
My Router is a Dual-Band, but still... it's behind a brick wall, above the natural ground level by 3 feet. Don't get me wrong, I was not connected at 54MBPS, but I had a connection 1900 feet away.

Third try:
As shown in the picture above: 3,546 ft (1km) on a non direct line of sight: Router inside a house, behind trees.   So, don't look any further, This is the card you want! Forget about the Hawking, Edimax & D-Link. Get that one!
And you know what? : It's cheaper than the Hawking!!!

So, here is the link, and yes, it's a referral link. So, why use this link?
A) You have the absolute warranty to receive a genuine product, and not a non-working knock-off. It's a plug-scan-smile product. (Only 3 Authorized dealers in the US)

B) The Other business that sale this card has NOT a good reputation as per warranties and returns. Check the KisMAC-ng team review. Consider yourself as warned.

C) The Other business is more expensive: the same deal will run at $48 for the exact same bundle
C1) One Biz is selling Kock-Off from China and ships To CA. Here again you have been warned, example at the end

Links to the Card, Reviews and Tips

Do NOT buy any other card. This reference only. Other Chipset are not / may not be compatible.

Before buying, read the paragraph below to determine your needs and Check my test to see how the Alfa just by itself blew away a Hawking equipped with a High Gain Directional Antenna.

If you live in a Urban Area, Campus or the Suburbs
Alfa 1000mW + 5 dBi antenna + 9 dBi antenna + Suction cup mount

Best Deal, BEST Choice
Alfa 1000mW + 5 dBi + 9 dBi + Suction Cup Mount

If you live ONLY in a Urban Area, Dense WIFI Area

You do not really need the 9dBi Antenna, but hey, it's almost the same price ($5 difference. Seriously, get the previous one) This one has no suction cup mount either. (Told ya! get the previous one.....)

Alfa 1000mW, 5 dBi antenna

The Network Adapter is provided with a 5dBi hi-gain Antenna. Due to the nature of the WiFi RF, you do not need a ultra long range antenna, RF are bouncing between buildings and you can not expect to reach long distance: You line of sight is fairly limited, but the power of this USB adapter and it's sensitivity are more than enough. I get over 45 AP's with a 5dBi in the 'burbs

If you live in a Bunker, Deep Basement or a Cave.
Get this 15ft USB extension. It's almost cheaper than rope!
If your cave is really deep, get 2 + a hub, or an active USB . I know .... big expenses! and keep on reading, it explains why you should get a USB extension Vs. an Antenna Cable Extension (Cheaper & Better)

Suburb / Wardriving

The equipment provided in the box should suffice.
If your suburb is sparsely populated or if you are in a dense wooded area, you may want to use the 9dBi antenna.
Magnetic Mount Antenna : Easy Wardriving, or for having the antenna outside.

For Wardriving, you can add the GPS, always useful ;-) I am having a blast with it.
For GPS, I would avoid Holux like the plague: As soon as it's sold, you are on your own. They have no support whatsoever and the worst consumer service this side of the universe

How to get a better WIFI Signal Explained here
Cable Vs USB explained here

Not compatible with KisMAC

Alfa AWUS036NH (2000mW) has a different Chipset, (Ralink RT3070 ) NO drivers available for KisMAC yet.

Gsky Blue Proton should work, it's a knock off of the Alfa, But this card is known as junk. I do not endorse this card nor provide any support for it. when you buy it, don't forget the Kleenex: You Are Going To Cry.

Rokland N3 , not compatible

By experience, I came to realize that spending 8 hours to get a half baked fix in order to save $5 was not worth it. If you believe that your time is worth 62 cents per hour, feel free.......
Shipping back a junk card will cost you more than getting it right the first time.

Copies, Knock Off, Counterfeit Cards

Example of an Un-Authorized "Reseller" on eBay: Copies & Knock Off
For your own sake, only buy from Alfa Authorized Dealer: 3 only in the US

Example of an UN-Authorized dealer. I do not know if they sell counterfeit Products, but if you read the fine print..... I have highlighted that for you ; -)

...undamaged item in its original packaging (where packaging is applicable). Packaging should be the same as what is found in a retail store, unless the item is handmade or was packaged by the manufacturer in non-retail packaging, such as an unprinted box or plastic bag

and get a "big picture"

Copy of the comments left on the eBay page of an unauthorized reseller.

Kismac: The Ultimate WiFi Stumbler

2011-06-14T23:00:00.003-04:00

How to Crack WEP / WPA Step by Step
KisMAC for Dummies & Step by Step KisMAC Tutorial
KisMAC Tutorials for dummies, beginners & advanced users

Update of update : a Brand New Improved Video in HD, con la musica muy entertaining is available at the end of this post. it should cover KisMAC 101 and walk you trough WEP and WPA cracking

For the curious, advanced users and KisMAC geniuses , we have the following articles available:

Best Wifi Card for KisMac about 20 X more powerful than Airport or Hawking

Troubleshooting KisMAC
KisMAC Q&A
Cracking WPA with KisMAC
KisMAC Resources
KisMAC Deep Digging , Advanced Features
How To Install Aircrack On Mac

Best Wifi Card for KisMac about 20 X more powerful than Airport or Hawking

Before you post a question, PLEASE be sure to Read the 3 following post:
KisMAC + KisMAC troubleshooting + KisMAC Q & A

Once you are sure that the answer to your question can not be found, Please, Post your question in the Q&A Article: CLICK HERE.

ALL QUESTIONS WITHOUT KisMAC Version and OS Full Version will be ignored. Please Include Model and FCC number of the Network Adapter (the USB thingy) if applicable. And YES the FCC number is on it! and NO, it's not the MAC address.

Cracking WEP with Injection
Cracking WEP without Injection (Airport, Airport Extreme)
Cracking WPA
KisMAC Troubleshooting Guide
KisMAC Resources Dictionary file, Password list, etc

KisMAC is a free WIFI Network discovery tool and has a large array of powerful features: Detection, Authentication, Injection, GPS, and the ability to crack WPA & WEP keys.
KisMac is really powerful and leave Windows based NetStumbler in the dust. By a large margin.

Kismac is not for absolute beginners and the first step with KisMAC is to read the FAQ. The second step is to read the FAQ again.

Just a little legal warning:
- It is illegal to download, possess, and/or use Kismac in Germany, Austria, Switzerland and Lichtenstein (StGB § 202c)*
- It is illegal, in most countries, including the USA, to crack or attempt to crack, penetrate, listen to, intercept, or “Inject” any WI-FI network others than yours, or Networks where the unequivocal permission was not given to you by the rightful owner.
- Kismac is a tool that should be used on the sole purpose to check and/or verify, audit your own network

Now that I warned you :-) you can enjoy it!

Cracking WEP with Re-Injection

Whatever you do, if you have an injection device (WIFI card or USB Adapter) DO NOT install the drivers of the card / USB adapter.
DO NOT INSTALL DRIVERS FROM THE CD PROVIDED WITH THE DEVICE unless you have read this post

How to Crack WEP Step by Step

This tutorial is solely for you to audit your own network. I take no responsibility whatsoever, implied or not.
If you NEED an access, just ask politely your neighbor and either share the cost or discuss with him. A six-pack can be used as lubricant.

Cracking with Injection device

(Hawking HWUG1 shown here, RT73 Chipset. DO NOT BUY THAT ONE

Read review and comparison before: best card is here

Best Wifi Card for KisMac about 20 X more powerful than Airport or Hawking

The most successful method by far, with one little issue: you will NEED a Re-injection device: Either a USB WIFI Adapter or a WIFI card.

But, here comes the trick:
-You cannot use any WIFI card: You must use specific ones.
The list of “approved” hardware is here: http://trac.kismac-ng.org/wiki/HardwareList
As of today, you can NOT inject packet with your Airport / Airport Extreme Apple card alone.

Step 1
Download KisMAC from a trusted source such as: http://trac.kismac-ng.org/wiki/Downloads
Install KisMAC
Plug your Injection device, Whatever you do, DO NOT install the drivers of the card / USB adapter, or you may dearly regret it.
Start KisMAC

Step 2
On the Tab KisMAC >>> Preferences >>>Drivers
Select your Injection device i.e. : “USB RT73 device”
If you have a doubt on what to choose, check the "approved" hardware list.

Click on “Add”
Check box “Use as primary device”
Select ~~“All Channels”~~ Correction: Select only 1-11 If you are in USA, 1-13 If you are in Europe, 1-14 if You are in Japan.
In some Cases, Ch 12-14 can pick up interferences from other home devices: Stay within 1-11 !
Check box “keep everything”
Close Dialog Box

Step 3
On the main screen, select “Start Scan”
KisMAC is now listening to the accessible networks
Look for a network with a WEP key (column “ENC”), a good signal as well as traffic (see Packets and Data)
OR
Enter “WEP” on the search box (top right) and select “encryption” to filter the results

If the Column ENC is “NO”, the network is OPEN: No need of cracking anything
Once you have selected a network, look for the CHANNEL of the network, i.e 1, 2 etc …
Go back to Preferences >>>> Drivers
Select only the Network selected i.e 1

Step 4
Let KisMac work for 5 minutes collecting data
On the “NETWORK” Tab, select “Reinject Packets”
KisMAC will now try to reinject packets to speed up the process
Keep an eye on the “Unique IV’s” number, once it has reach at least 130,000 (200,000 is recommended) you may start considering cracking.

Step 5
Once you have collected enough, On the NETWORK Tab, Select “Crack” >>> “Weak Scheduling Attack” >>> “Against Both”
KisMAC will now try to crack the key…
Reminder: the more Unique IV’s you have collected, the greater are the chances to crack the key.
I have experienced crack as fast as 10 sec with 200,000 Unique IV’s (on a 64 bit key) and sometimes 30 minutes with only 110,000

If you know for sure that the key is either 40 bit or 104 bit, then select the appropriate one. If you are not sure, select "both"
40 bit is a 64 bit (40+24)
104 bit is a 128 bit (104+24)

If you have followed the steps, you should see something like that appears :-)))
remove the semicolon, and there you have it, or take a look at the main screen under Key or ASCII Key

How to crack WEP / WPA with Airport Extreme, Passive mode
WITHOUT Injection Device (Airport, Airport Extreme Alone)

WEP attack

Step 1
Read the FAQ http://trac.kismac-ng.org/wiki/FAQ
Step 2
Read the “Newbie Guide” http://trac.kismac-ng.org/wiki/NewbieGuide
Step 3
Download KisMAC from a trusted source such as: http://trac.kismac-ng.org/wiki/Downloads
Last build is 0.3.3

Install KisMAC
Start KisMAC

Step 4 (without an Injection Device)
On the Tab KisMac >>> Preferences >>>Drivers
Select your card. (Capture devices) i.e : Airport Extreme Card, Passive Mode
Click on “Add”
Select Channels 1-11
Close Dialog Box, and select “Start Scan” on the main window
A dialog box opens and load the card. Your Admin password may be required.

Step 5
KisMAC is now listening to the networks accessible
Look for a network with a WEP key (column “ENC”), a good signal as well as traffic (see Packets and Data)
If the Column ENC is “NO”, the network is OPEN: No need of cracking anything
Once you have selected a network, look for the CHANNEL of the network, i.e 1, 2 etc …
Go back to Preferences >>>> Drivers
Select only one Network selected i.e Channel 1

Step 6
Be patient: open a beer, pour yourself a nice glass of wine or have a nice cup of coffee.
Without an injection device, you will need to collect a minimum of 130,000 unique IV’s before you can start cracking a 40/64-bit WEP
Recommended:
200,000 Unique IV’s for weak scheduling attack on a 40/64-bit WEP
1,000,000 Unique IV’s for weak scheduling attack on a 104/128-bit WEP
It may take a long time (based on: Network traffic, re-injection or not)

Those are recommendations. Weak Scheduling is basically a statistical attack: The greater the number of IV's collected , the greater the chances.
Are you in a hurry? : Capture with KisMAC, Crack with Aircrack-ng
You can have a successful recovery with as low as 21,000 IV's

Step 7
Once the packets are collected, Go to the tab “Network” >>> Crack and select the method,
For a start, I would suggest: “Crack” >>>”Weak Scheduling Attack” >>> “Against Both”
Once started, you’ll have to wait between 5 and 20 minutes depending on your machine for KisMAC to try all the keys.
The more packets you have collected, the better are your chances to be able to crack the key: The WEP Attack is Statistical, hence ....

WPA crack / Attack

>>>>> Packets RE-Injection DOES NOT WORK on WPA attack <<<<<<
>>> I said RE-Injection and not "Injection"

In order to crack a WPA key, you'll need the handshakes, a serious dictionary file or fileS and a LOT of CPU time. Hours and probably days of it. (read the "I am bored part" at the end)

You first need to capture 4-way EAPOL handshakes (connection between the computer and the network) -When captured, you'll see the Ch/Re red dot turns green. You are ready to try...

To speed up the process of capturing the 4-way EAPOL handshakes, you can try a deauthenticate attack: it will force the network to shutdown and restart, hence speeding up the process.
Go to Network >>> Deauthenticate
Some network may recognize the attack and change channel.

Once the Ch/Re is ready, Go to the tab "Network" >>Crack >>WPA
It will then ask you for the dictionary file, select the file you want to use, and start...

Nota Bene:
KisMAC will try every word (from the list provided) to attempt to crack the key, hence it may take a lot of time....if you have a slow machine, be really patient.
I have a not so bad machine, and I run about 170 words per second. You can leave a comment with your config and speed for me to compare.
Mine: MacBook Pro 2.5GHz Intel Core 2 Duo + 4GB DDR2 SDRAM : about 170 Word/sec

As for the Dictionary files, you can find links on the KisMAC website or take a look at the "RESSOURCES" post.

Note on dictionary files:
Wordlist = dictionary file
- The words are tested "as is" and not in combination.
Example: the password is "I love Kismac"
If your dictionary contains the words "I" + "love" + "Kismac" it will NOT work, your wordlist must contain the exact (verbatim) "I love Kismac" as a word to successfully attempt to crack.
The files must be a text format .txt and contain a empty line at the end.

KisMAC Troubleshooting Guide , KisMAC Issues, KisMAC Ressources are on the NEXT post....
KisMAC for Windows, ditto...next post

WPA: Wordlist links and files Download are here

KisMAC Ultimate Stumbler Ressources & Troubleshoot

2011-06-14T22:00:00.009-04:00

Troubleshooting KisMAC
KisMAC Tutorial

Resources

If you leave a comment or if your question is somewhat technical, please include detailed information.

KALI Reporter.app will do that for you!

Either visualize the report and post your system profile/info needed, or if you do not want the info to be seen publicly, just send the report via email. KALI Reporter takes care of everything. Please don't email your question.... post it on the blog.

Troubleshooting KisMAC

KisMAC 0.3+ Bugs
KisMAC 0.3+ Issues
KisMAC 0.3+ Not Working

KisMAC 0.3+ Bugs, KisMAC 0.3+ Issues, KisMAC 0.3 Not Working

-Did you noticed that KisMAC 0.3 is for Snow Leopard 10.6 ? and not for 10.5? ok....

Can't Scan with KisMAC 0.3

"NOTE: If a previous installation of KisMAC has been used, please make sure to delete the following files, if they exist:" ( '~' is your home folder) (Using App Cleaner IS a GOOD IDEA)

~/Library/Preferences/de.binaervarianz.kismac.plist
~/Library/Preferences/com.kismac-ng.kismac.plist
~/Library/Preferences/org.kismac-ng.kismac.plist

Message
Could not instantiate driver. KisMAC has not been able to load the driver backend
Could not initiate driver. KisMAC has not been able to……

Whatever you do, if you have an injection device (WIFI card or USB Adapter)

DO NOT install the drivers of the card / USB adapter unless you have read this post

Possible causes:
You have NOT selected "Use As Primary device"
You Have NO Drivers selected
You have Selected the wrong one
Your Chipset is not supported (see Hardware list)
The Chipset of your USB Network Adapter is not correct (See FCC Number)
In order to avoid those issues => Best Wifi Card for KisMAC

If you look in your console.log (Spotlight >> Console)
you'll probably see a lot of lines with KiMAC as "sender" and an error messages such as:

KisMAC[2928]    vendor 1452 vendorId 3574 product 32773 productId 38674

KisMAC[2928]    Matching finished

KisMAC[2928]    Error could not instantiate driver WaveDriverUSBRalinkRT73 

Reading the last line, you can easily guess where the issue comes from: RT73 driver can't be loaded. Why? because you specified to KisMAC not to, or Specified to KisMAC to load the wrong one.
Solutions
Select Appropriate Driver or use the proper USB Network Adapter. You may need to Force Quit the application
You have installed drivers provided with the CD of your USB Network Adapter.
Solution 1:Time machine? if you have Time Machine set up, pat yourself on the shoulder: smart guy!
If not, time to think about it and move onto Solution 1.5

Solution 1.5:
Uninstall the drivers* and the all shebang provided with your injection device
including the proper .plist for Kismac
use AppCleaner to remove all .plist
OR if you had a previous install, remove the following, if any:
~/Library/Preferences/de.binaervarianz.kismac.plist (where '~' is your home folder)
~/Library/Preferences/com.kismac-ng.kismac.plist (where '~' is your home folder)
~/Library/Preferences/org.kismac-ng.kismac.plist (where '~' is your home folder)
(told ya' use AppCleaner)

Solution 2: If, after uninstalling the drivers*, the problem persist, -and- you have trouble with your Airport Extreme, you may be in for a shitload.
Uninstall KisMAC, and re-install

Injection does not work
- Check that your device (USB/Card) is able to inject, => see Best Wifi Card for KisMAC
- Test injection: Tab “NETWORK” >>>”Test injection”

- Check that you have checked the box “use as primary device” in tab Preference >>> Drivers
- Check that you have the proper driver/chipset selected i.e. USB RT73 or USB RT2570 (Preferences >>>Driver)
- Check that proper channel is selected. One channel only: You cannot inject while Channel hoping is selected

- As stated, be very careful to have the proper chipset, otherwise: nada!
Word of advice, I would suggest you to test the hardware in a “brick and mortar” shop before you buy something that will not work, or take my word and experience for it, and purchase the best card available for KisMAC, it's less than $35 and allows you to get a signal up to 1 mile. it's 20x more powerful than an Hawking.

Reinjection Not Working

If you have tested the Re-injection and your card should re-inject packets, you may have the following issue(s)
- Your card is not powerful enough for the signal to reach the AP => get this one: Best Wifi Card for KisMAC
- There is not enough "good" traffic on the network. IV's (Initialization Vectors) are only about 5% of good traffic.
You also have the remote possibility to have encountered a very rare breed of APs: The one equipped with "WIPS" (Wireless Intrusion Protection System). In that case, Passive Mode is the solution.

If you want to know more, here is an excerpt from the KisMAC FAQ.

"What is packet reinjection?

802.11 requires frame retransmissions in the case of loss, so it may be possible for an attacker to retransmit a frame and replacement injected frame to be accepted as legitimate. Frames on wireless networks can easily be tampered with or forged outright, and the protocol does not provide a way to easily stop or even detect such attacks. Acknowledgment (ACK) and Address Resolution Protocol (ARP) are the management frames that are likely to generate responses from the client and AP

Packet reinjection is a very advanced WEP cracking technique. Be aware that this is the bleeding edge of technology, so it might not work every time. When you use this attack, KisMAC will try to find packets that will cause another computer to respond. The program will then send these packets over and over again. If KisMAC detects answers, it will go into injection mode..... Please be aware that all detections are of a heuristic nature, therefore it might not always be working"
Source: KisMAC

Packet collection is very slow
It’s probably because the network is not very active (low traffic). Just go on YouTube, watch few videos and the packet collection should increase very quickly.

Crack does not work
-Well, as stated in the FAQ, Injection is the bleeding edge of this technology, and I have experienced myself some failures with my own network: I was unable to crack my own key with more than 1,000,000 unique IV’s.
Other possible causes:
The key was changed during the collection
You have selected a 40/64-bit WEP when the key is 104/128-bit WEP, so in doubt, play safe and select both
You have encountered a SOL error: Shit Out of Luck

The wpa key could not be recovered because of the following reason:
the key was none of the tested passwords.."

Most likely, your dictionary file does not contain the exact password, read the article about wordlists.

WPA Reinjection Does Not Work
please note that RE-Injection and Injection are not the same.

-WPA RE-injection will not work, you can only RE-inject on WEP network, if you have an injection device. (i.e When you Deauthenticate , you are injecting frames)

KisMAC Crash on WPA Wordlist
KisMAC Can't Perform Injection Test
This is bug with KisMAC 0.3.3 while on 64-bit
Go to Applications >> KisMAC.app >> Get Info
Check "Open in 32-bit Mode" and restart.

Could not load Airport Driver

KisMAC could not attach to the Apple Airport Driver

This Error Can Have Multiple Origins, Please Read Carefully.

KisMAC could not attach to the Apple Airport Driver
In Preferences >>> Driver
You may not have selected any Driver (Apple Extreme, RT73, etc etc )and pressed the "Start Scan" button multiple times, this provokes a freeze and return this error.
The "Start Scan" button looks like the one in the picture below (button engaged)
The solution is a Force Quit and to select a correct driver in Preferences >> Driver

KisMAC could not attach to the Apple Airport Driver
Cause: Airport, Airport Extreme in ACTIVE Mode
This issue is fairly new and is related to the brand new Snow Leopard (10.6)
You have this error because you have selected Active Mode
Close KisMAC , re-open and select Passive Mode.
Do not use Active Mode with OS X 10.6 until further notice.

No Driver Selected
Please Select a WIFI Driver

Go back to Preferences and Select a Driver
i.e. Airport Extreme Passive Mode, USB RT73 Device, or else.

KisMAC Ch/Re Gem
The Ch/Re Gem is situated on the last column, right after "last seen"
Ch/Re stands for Challenge / Response
The Gems have 3 colors possible: Green, Orange and Red and the meaning will depends on the type of encryption of the Channel/Network

Enc = NO
The Network has no encryption (Open), (under column "Type") the Ch/Re Gem is green by default
Enc = WEP
The Network is encrypted by a WEP key, the Ch/Re Gem is red by default and indicates that Kismac does not have recovered a key (yet) No Challenge or No Reponse
Green Challenge or Response
Orange has a Challenge OR a Response
Enc = WPA
Red: No handshakes captured, don't even try a wordlist
Orange: Capture Started (?)
Green: Handshake Captured

KisMAC Freezes
KisMAC Hangs

KisMAC Freeze, KisMAC is hanging, KisMAC Freezes, PinWheel KisMAC

If KisMAC Freezes after few seconds, and hangs (Pinwheel) the first cause that comes to my mind is that you are using (listening to) the wrong channels.
If you are in USA, you should not be using Channels 12,13 & 14 (Europe and Japan)
If you are in Europe, You should not be using Channel 14 (Japan Only)

Just uncheck 12,13 & 14, that should resolve the problem.

Possible cause: Channels 12,13 & 14 are close to the microwave range and cordless phones (old ones)
It's possible that you are listening to your coffee or pop corn.
A second cause could be a large number of router using the same channels (often Ch 6), it may also create issues on your own network. In that case, just switch channels and you'll see an improvement in your Network quality

Can't Collect IV's
Can't Collect Packets
Packets Collection is very slow

I have received a lot of questions about this issue. The most probable cause is a non active network.
A non active or slow network (low traffic) is what makes the collection very slow.
KisMAC in passive mode is like trying to collect rain water: The more it rains, the more you can collect. That simple! If it does not rain .... or very little ... you got the idea!
A good wifi card will help you solve this issue

After receiving 10 + questions on the subject, here is an example of a near silent network:

As you can see 614,847 management packet (beacon) and only 25,945 Data Packets (the good stuff)
so, 615,902 junk.
This network is simply "on" but not used, hence, as long as there is no valid traffic, you need to be more than extremely patient

Other possible cause: You may be listening to a Probe, or a Router not connected to the internet, or someone that left his router on, but does not use it. Read the post till the end...

Here is what I have tested with active networks, and very active networks. It clearly shows that the collection of IV's is related to the traffic.
The test is with an Airport Extreme, Passive Mode, NO Re-injection
It took me 5 minutes to reach 130,000 IV on very active network, and 126 min on Active.
For the numerous persons that still believe that Kismac can not crack on Airport Extreme, the following is going to be surprising:

Very Active Network
Time : 0:02:05 2min, 5 sec
Bytes: 83.42 MiB
Packets 58,423
Unique IV in 0:02:05 = 57,016
U IV/Sec = 456.12
Theoretical Time to reach:
130,000 = 285 sec = 4.75 min
200,000 = 438 sec = 7.30 min
300,000 = 658 sec = 11.0 min

Active Network
Time 03:23:50 3hrs 23 min 50 sec
Unique IV's in 03:23:50 = 210,216
U IV/Sec = 17.18
Theoretical Time to reach:
130,000 = 126 min
200,000 = 191 min
300,000 = 285min

1 As Kismac has loaded the Airport Driver, he has control over it. Proof that this is on Airport and not on USB
2 Time
3 Packets
4 Unique IV's Collected with Airport Extreme on Passive Mode.

a Kismac still on Airport
b Time 2min and 5 sec
c Unique IV's Collected with Airport Extreme on Passive Mode. = 57,016 in 2 minutes, roughly 11 min to 300,000
d Bytes = 83.42 MiB for 57,000 IV's

Hence, Kismac does work on Passive Mode, and yes, you can crack on Passive mode without Re-Injection. If you can't, it's probably because of the network quality or simply because you may have selected a wrong parameter.

Test Your Own
One way to be sure is to test your collection speed:
Go to a friend's house , Start KisMAC , and ask your friend to watch multiple Youtube Video on its network. You want to push the router to the max.
You'll be then able to see if the issue is due to slow network or not.
While you're at it, ask your friend to run KisMAC too: You'll be surprised to realize that you can:
A) exchange PCAP dump files and try multiple cracks on multiple networks
B) if using Re-injection, notice that ONE device will make ALL Macbooks able to pick up the responses

Macbook does not detect edimax ew-7318usg

It's NORMAL! Don't panic!!!
Your Macbook can NOT detect your Edimax, because your driver(s) are not installed.
KisMAC will detect your edimax, under Preferences >> Driver >> use USB RT73 Device
DO NOT INSTALL the Drivers provided with the install CD of your Edimax unless you have that!
if you do so, or have done so, please refer to Troubleshooting KisMAC.

Kismac weak scheduling attack takes a long time
A Weak Scheduling attack may take some time, but you (yes, YOU) can make much faster:
Don't start cracking unless you have a mini of 130,000 IV's
200,000 is recommended
You may have collected corrupted packets, Sorry: S.O.L , try again
Rule of Thumb: The More IV's Collected, The Faster The Crack Will Be.

Another solution is to install Aircrack-ng: Collect packets (collect or re-inject) with KisMAC, Crack with Aircrack-ng: it's 10 X faster

How Many packets I need for WPA?
None! For WPA, you need to capture the Handshakes.
Look at the Ch/Re Gem indicator , or read the post related to that question.

How Many unique IV's for WEP?
Number of unique ivs needed kismac?
KisMAC: It is recommended to start at a minimum of 150,000 unique IV's
You can always try under, but it will probably fail or the key recovery may take much longer.
Aircrack-ng: As little as ~~40,000~~ 20,000

How fast can I successfully crack a WEP or WPA?
How fast can you crack a WEP key?

You just opened a can of worms ...
WEP
KisMAC: The more IV's you have collected, the faster the crack should be.
I have successfully cracked my own WEP key in less than 3 sec (128 bits key)
I also have, on the same key, spent hours with no success, .... I had up to 2 millions IV's
I suppose some frames were corrupted, but I can't say for sure. I made a Video on YouTube showing a crack in less than 3 seconds.
Aircrack-ng: 1 second on a 64 bit key with 40,000 IV's

WPA
It will depend on your password. If you use a dummy password*: between 5 sec and few hours.
If you use a GRC generated password, you better explain to your kids how to do it: they will continue your work long after you'll be dead. Seriously!

If you NEED an internet connection because you just moved, are in a new place, can't afford the monthly overpriced FIOS or UberDuper connection, then you'll need a SA-6p, SA-12PSA or SA-24PO
it's not software anymore, it's hardware, but I was successful in cracking a WPA2 in very, very, little time.
I have heard of BIM attack with Ha100B series, but I never tried it myself.

BTW: Dummy passwords: lists ARE available :-), I URGE you to use very serious password and avoid at any cost guessable passwords such as: 123456, 1234567, password, letmein, mustang, iloveyou, etc etc ...

PCAP Dump
When you check the box "Keep everything" it start saving a file where a bunch of details are kept.
This file is accessible for later review (advanced user only, please) you can use Wireshark to read that file and discover all the little tiny details ;-)

Console Log (from Console.app)
it's the log of what is happening behind the doors when you use your computer.
If you keep console log open, you may find messages such as "Warning, deauthentication Frame received"
It means that somebody is trying to penetrate your network with a Deauthentication attack. (more exactly, trying to force capture the handshakes)

KisMAC Freeze, KisMAC is hanging, KisMAC Freezes, PinWheel KisMAC

KisMAC Questions & Answers

2011-06-14T21:00:00.001-04:00

KisMAC Q&A

Please, before asking, be sure to read the all stuff. Answering 5 times the same questions is time consuming.
There is a "Search" for the blog on the top left corner. Thanks!

ALL QUESTIONS WITHOUT KisMAC Version and OS Full Version will be ignored or Flamed. Include Model and FCC number of the Network Adapter (the USB thingy) if applicable. And YES the FCC number is on it! and NO, it's not the MAC address.

Image courtesy of Belkin

Example:
Kismac + OS X = Ignored

FCC ID : MAC 01:23:12:20:ff:88 = Ignored
KisMAC 0.3 + OS X 10.6.4 = Answered
Kysmaxx + win 95 = Flamed

Question:
"I got a pbm to get a wpa key.
I got the data packets ok, I get the green light with the deauthentification, but when I ask to find the wpa I get this:
"the wpa key could not be recovered because of the following reason: the key was none of the tested passwords.."

Answer:
The file used needs to have the exact password in it. The words are tested "as is" and not in combination.
Example: the password is "I love Kismac"
If your dictionary contains the words "I" + "love" + "Kismac" it will NOT work, your dictionary must contain the exact "I love Kismac" as a word to successfully attempt to crack.
Be also sure to use a proper formatted file: a simple .txt will work perfectly.

-----------------

Question:
2 questions :
- to crak wpa key what kind of USB device i need ? (name please)
- what does mean dictionnary file !??!

Answer:
Dictionary file OR Wordlist are files containing simple words or sentences to be tried against the key. They often contain 100,000's of words related to a subject, i.e. last names, first names, Yiddish words, bacteria, etc .. You can also find the 500 most used passwords
Or take a list and expand it by modification or concatenation*

Excel wordlist expander
link posted : http://aloah.free.fr/Mactips/home_En.html

*Concatenate: to add strings together. "qwerty" +"1234"= "qwerty1234"

-----------------

Question:
I can't collect IV's

Answer:
Look at the troubleshooting article, multiple answers posted

-----------------

Question:
what kind of USB device i need?

Answer:
Already posted multiple times

-----------------

Question:
I can't seems to be able to collect IV's / IV's Collection is very slow

Answer:
You need to look first at the number of packets collected:
Packets
Data Packets
Management Packets
Control Packets
Unique IV

We are looking at the ratio between Packets and Data Packets. Data Packets is the good stuff.
If you have a lot of packets with a lot of Management packets, it means that you are listening to a non-active network. A bit like if you listen to static on radio: Nothing good to listen to.

To give you an example, I have at home multiple WiFi Devices. Some are Wireless Backup HDD.
So, if you come near buy, you'll see multiple network. The Issue is that the Wireless Backup is NOT connected to the internet, and only "working" when I am doing a backup. So you could listen for a long time, getting management packets, but zero IV's, and very little good stuff.

The Other issue could be that everything is ok, but the connection is not very active. Somebody left the computer on and went to work. Almost no traffic. Packets collection is going to be slow.

What injection device should I use?
-The list of “approved” hardware is here: http://trac.kismac-ng.org/wiki/HardwareList
I have tried the Edimax EW-7318 USg, Hawking HWUG1 & HWUG1A (about $40)
The KisMAC Team highly recommends the Alfa AWUS036H (about $50)
I am not really impressed by the sensitivity of the Hawking “as is”, you may want to consider a high gain antenna, or the Alfa AWUS036H for better results.
I’ll try the Hawking with a directional antenna and post results, if any.

------------------

Question:
Can I use KisMAC with XP?

Answer:
Dear,
I am surprised: how can you write if you can't read? Are you two? one can read, one can write?
If so, ask your twin for an answer.

-----------------

Question:

J said...: hi there, congrats for the nice job here.... i woud like to ask you if on a MBP I get a usb device rt73 Hawking HWUG1 for ex, do I need to install subversion, xcode and compile kismac explained on this link? http://screammy.name/projects/kismacmacbook/ I really hope not.... :) Will you advice me about the USB devise "rt73 Hawking HWUG1 "and "rt73 Hawking HWUG1A" , whats the diference between them and your opinion about this USB DEVICE "D-link DWL-G122? This blog will be from now on my favorites... Thanks in advance and keep the good work J. Answer(s)..
Hey J, thanks for the cheer up.
Do I need to Compile KisMAC? ABZOLUTELY NOT
the post on screammy.name is from 2006 (updated in 2007) ... KisMAC has evolved ...
~~"The current distribution of KisMAC does not allow you to use the AirPort Extreme card in passive mode"~~ Yes it does...
Assuming that your are on OS X 10.5 or 10.6, Just download the version 0.2.99 available by link here:
http://aloah.free.fr/mactips/Menu.html Via the Download Menu; Then Watch the video "how to" http://www.youtube.com/watch?v=lBGN5OGCPgI
Watch Again. (specially the warning) If you don't, you WILL be sorry. Breath, take a break, and watch again.
Hawking To the best of my knowledge, the difference between the two are: one is 11g and the 1A is 11n.; As for Hardware, what you want to be sure about is the chipset.; The chipset is the "engine" Never mind the body, you care about the engine.; hint: double check the FCC number (and you'll realize that different brands have the same engine); If you buy a non compatible....Kiss good bye to your $ D-link DWL-G122 has different revisions number : http://trac.kismac-ng.org/wiki/DWL-G122 So, I would apply the following formula: (CFU x D) -MS ^SOL; CFU = Chances of F* up; D= Distance; MS= Money saved; SOL= Shit out of luck factor.; In Short: Save 10 bucks to be in trouble and re-ship the all stuff and wait 2 weeks. Do not get your money back for the shipping, and get upset because "I did not know"...; Hawking, Edimax, Alpha or anything known to work without issues .... ;-); I suppose you will read the troubleshooting and Q&A completely. You will save a great amount of time by doing so. How much time? Well, can you do it is less than 4 seconds?; Queries from Goog Analyticskismac ch/re >> Green, Orange or Red. All others colors are products of your imagination. - This is your way of asking a question - direct from the search bar in Google. If you have arrived here, it's probably because your question was formulated in a strange way, but you are very close to an answer, just use the search on the top left of the blog. I'll provide very short answers below Injection Airport Extreme >> Airport extreme can NOT inject or Re-Inject kismac could not attach to the apple airport driver >> 99% chance it's your fault. look into "Preferences" Kismac injection does not work >> Test injection (Command + T) Kismac injection not working >> Test injection (Command + T) kismac weak scheduling attack taking long time >> Look at troubleshooting kismac ew-7318usg tutorial rt73.plist >> App Cleaner ?? mac uninstall kismac >> App Cleaner + Plist Question: ..I have an issue with KisMAC "hanging" for some minutes in a specific channel... it's not always the same, but 'till this moment it has only happened with ch 11, 12, 13 and 14... the other channels pass fast, but on these channels it "hangs" for some minutes and then continues the scan... Answer: Uncheck the Channels 12, 13 and 14. Those channels are not used in most countries and it can create interferences: You are probably trying to listen to a microwave oven or an old cordless phone.

Cracking WPA with KisMAC

2011-06-14T20:00:00.002-04:00

Cracking WPA with KisMAC

1) How To
2) Probabilities
3) Energy Needed
4) Size of Wordlist files

I have received a lot of questions in regards to cracking WPA with KisMAC, or any other "WPA cracker"
Alas, a lot of them showed deep signs of misunderstanding in regards to the basics of WPA. (Not WEP, WPA!)

If you are here for the dictionary attack files, you may want to consider this page HERE
You may make a small donation and receive a pack of State-Of-The-Art WPA Dictionary Attack files or Wordlists

For the Top Used Passwords, it's here
For Installing Aircrack-ng on your Mac, it's here (10x recovery speed)

Otherwise, if you are on the cheap side, and before I start, I would suggest you to watch the following video. If you already know KisMAC jump directly to 05:14.
If you are not a KisMAC expert, watch it entirely. Take a pause. Repeat.
http://www.youtube.com/watch?v=Pyiz2Mct6dk

Few Things:
We are here, specifically talking about KisMAC & Aircrack, Not "pro" rated dedicated hardware or large scale operations (Electronic Frontier, CIA, NSA, Botnet & Al.)

- WPA passwords have between 8 and 63 Characters
- The only known (as of Jan 2010) vulnerability to WPA is a Bruteforce attack.
- A Bruteforce Attack is simply to try password after password after password.... either precomputed or listed in a file.

The password or "Key" in a WPA is "Salted" and "hashed", Hence when KisMAC or Aircrack "read" a password in a Wordlist, it has to "de-hash" the password 4096 times before really trying it!
The precomputed solution involves rainbow tables, the downturn is that you have to stick to specific precomputed tables only working whit ONE specific SSID.

A Bruteforce attack is:
a) Time consuming
b) The most "simplest" attack, hence the dumbest.
c) Time consuming
d) Not guaranteed to work
e) Time consuming

If you are in hurry, you can jump directly here and start downloading wordlists and dictionary files, but before you do, I would highly suggest reading the following or you may find yourself highly disappointed.

Tip #1 Having Aircrack-ng on hand and ready to run is a very good idea: It will make any recovery attempt about 10 times faster. Even better, take a try at Pyrit-cuda. Pyrit-CUDA is at least 2 times faster than Aircrack-ng. Sometimes, much much more...

Tip #2 A Wordlist is only as good as the password listed inside. You can find wordlists of about 30GB in size that contains 99% junk. It's useless! and you waste 99% of your time.
A good wordlist should be composed of known password used by real people, and sorted by most used first: It may shorten you recovery attempt by few hours ....Or days ....

This Dictionary is made only of real passwords, then all occurrences are counted and then sorted by the most used first.
Why? humans are really bad at passwords, so they tend to use the sames ones.
When you generate your own wordlist, the generator often creates them in a alphanumerical order.

- Let's pretend that the password to crack is "123456789" and that you are generating a Wordlist made out of:
- Only numbers
- Between 8 and 10 Character long

First issue, the Wordlist is 14,560,526,225 characters long, and that translate to 14560 MB
Second issue, the password 123456789, will be, at best , on position 123,456,789 and it would have taken you about 114 hours to reach that position.
If you have a "smart" Wordlist, with the most used first, you're in for about 1 second.
(123456789 is one of the most used passwords)
So, it's your call: 114hours or 1 second?   Personally, I would take the shortcut

Now, if you plan on all Alphanumerical characters, 8ch long, it's 2 petabytes of size ...

You can create your own, download them, or take the shortcut

You can also read more about hacking Wireless: I personally highly recommend
the following book: Hacking Exposed Wireless, by Cache, Wright & Liu. Joshua Wright is the Author of the CoWPAtty software.
Everything is explained in detail, from the ground up.

Back to business: Cracking WPA

Step 1:
Capture the 4way Handshake
Before doing anything, you need to capture the handshake between the AP (Access Point) and the Client. The handshake is sent when a client connects to the AP. This process of "listening" to the AP-Client can take some time. In order to speed up this process you can use a Deauthentication Attack. The Deauthentication is a bit like a Ddos and will simulate a "kick out"and force the AP to respond.

Step 2:
Once the handshake has been captured (green gem), just use either:
KisMAC or Aircrack-ng. Just for speed sake, I use Aircrack. Aircrack is churning about 10 X faster than KisMAC when it comes to WPA.

As a repeat:
How to install Aircrack Native on Mac
Pyrit-CUDA on a Mac

Why is it so long to crack WPA?

You may noted that I mentioned "Time Consuming" 3 times.
Here is why:
First, the shear number of possibilities is mind boggling! A WPA is between 8 and 63 characters long. (numbers, LETters and signs)

Second, a WPA password is "Hashed" and "Salted". No it does not mean "cooked"
it's the old trick of taking the character "H" and transforming it into a "Z" for example.
Now, if you do that on a table of 127 characters, multiple times in a row, it's getting complex to decipher.
Well, a WPA is hashed 4096 times ....
So, Aircrack-ng or KisMAC have to churn 4096 times before trying the password. Trying to decipher a Pairwise Master Key (PMK) is equivalent to pushing about 1MB of data trough your CPU. 1400 PMK/s is 1400 MB sec of data being computed. This is why you'll see 99% resource used. The CPU is at full blast!
It slows down the process, and it's made for that purpose.

One solution is to use your GPU to help the CPU crunching data. (CUDA) and the other is to pre-compute the PMKs. Once precomputed, Pyrit will go trough it like soft butter.

It is widely recognized that, you have a chance to find the password before you run the all test. That chance is 50%.
Hence, you -theoretically- could find the password in half the time needed to run all the possibilities.
That was the good news.

Now, the bad news:
Probabilities
Energy Needed
Size of Wordlist files

Let's assume that a "password" to be cracked is composed of 1 Character and only composed of numbers:   The possible solution is either : 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
We then have 10 possibilities maximum.

Now, we move to a 2 characters password
The possible solution is either : 0, 1..., 11, 12, ....22, 23, 24....95, 96, 97, 98, 99
We then have 100 possibilities.
Adding a simple 1 character to the password made the possibilities jump from 10 to 100.
We understand now that it's not a multiplication, but the power of.
The issue?
We said previously "WPA is between 8 and 63 Characters"
Numbers : 10 Possibilities per digit
10^8 = 100,000,000.   That is 100 million possibilities
If the password is 63 Characters long:
10^63 = 1,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000

That's a vigintillion (!)

And this number is only for passwords made only of numbers.
Now, go get an Advil and come back after.

Picture that: Each password has the size of grain of sand! very fine sand, about 0.15mm
ok? Pictured?
Now, you have Aircrack-ng installed, and run about 1750 passwords per second
Let's assume that you know that the password is made ONLY of letters, mixed Cap.
You also know that the password is 10Ch long, something like that: "MyPassWord"

As you do not have any statisticaly sorted Wordlist, you'll try them one by one, starting at:"aaaaaaaaaa" and finishing at "ZZZZZZZZZZ"
So: "aaaaaaaaaa" "aaaaaaaab" "aaaaaaaaac" "aaaaaaaaad" etc etc

You now have an hourglass, and the sand flows at a rate of 1750 grain of sands per second....
So, your 10^52 possibilities translate by an hourglass of ? size please?
Only 60 cubic miles!
at the rate of 1750 grains/second, you will fill a inch cube in about 45min , or a cubic foot in a bit less than 54 days...
That is unless you have a statistically sorted Wordlist.

Possibilities by Character type:

Numbers only:                         10 per Ch.
Letters, lower case                   26 per Ch.
Letter, lower and upper case    52 per Ch
Numbers + Letters                   62 per Ch
Numbers + Letters + Shift 74 per Ch    !@#$%^&*()_+
Printable Characters                127 per Ch    (including "space")
Full ASCII                               255 per Ch   (including "space")

So, here we are.
A very stupid "average password" length of 9 Ch, composed of letters only, will run at:
2,779,905,883,635,710 possibilities.
If the "password creator" had the bad idea to use the full range: 4.55892E+21 possibilities.

So, as KisMAC runs at about 150 passwords per second, you can expect to crack a WPA using "blind bruteforce" in a bit less than ......

Take a guess...

6       Months?
13,7 Years?
900 Years?
131 Million Years?
Longer than the universe has existed?
10 times longer than the universe has existed?

And your answer is .... ?

Click here to find.

So....
Doubtful?

Okey, I know .... rainbow tables, precomputed tables, distributed attack and Moore's Law.
So, your dad is Bill Gates, and he buys you 100,000 computers running each at 1,000,000 passwords per second.
Still, a mere 23,611,832,414 years to go.... Still twice as old as the universe.

If ALL the people on earth had a laptop and were doing it simultaneously, it would still take 2.2 billion years to crack a random password type: -M ^7$:@é

The mythical googol number 1 and 100 zeros is reached at 42 characters ASCII password: 1.1876E+101
So, the odd of cracking a 42 ch at the first try is equivalent to tossing 333 coins in the air and having all of them landing on the head.

But here comes the funny part....
Supraconductor CPUs are not invented yet .... hence, you consume energy and produce heat ...

My MacbookPro, as per Apple, can consume up to 263 Watts and produce up to 800 BTU/h on intensive use. Password cracking is very intensive.
Where i am, a kWh is about $0.20

So, what could be the cost of running a Bruteforce attack on a 9 ch long password, full ASCII?
Very simple ... time x power needed = 4.98681901 × 10¹⁶ gigawatts
In short, you'll need more electricity than the world produced in 2006. About 3 times more.
The electrical bill would bankrupt the USA, and you'll produce a heat wave able to boil an ocean.
BTUs speaking, it's equivalent of burning: 1,196,836,561 Billion of gallons of gasoline
or just 7,978,910,409,456,55,000 Cords of wood (a Cord is 3.6 cubic meter (for you metric adorateurs)

The cost of the joke, as of 2010, would be $ 9.9 Trillions of Trillions of Dollars.

So when I hear, or see, people pretending cracking WPA in 75% of instance in less than 2 hours... I have some doubts ... I seriously would like to see that with my own eyes.
All demos on YouTube are showing either: Password known by the demonstrator or pseudo test made with 2 ch left to find.

In my humble opinion, cracking in "Blind mode" is just pure waste of time and electricity. You have greater chances to win the lottery than to crack a random 15 Ch in your lifetime. (with our actual possibilities)

The third reason why I don't try in "Blind Mode" is the shear size of the Wordlist(s).
Let's take a look and assume that you know that a password is only composed of numbers, and Oh! luck! it's JUST 8 Characters. In Short a baby WPA password.
As you do not know any of the numbers of the password, you decide to create a wordlist with a generator
Starting at 00000000 and finishing at 999999999 (all permutations)
the result will create a dictionary file (.txt) of 954 megabytes

For the Geek of it , look at the following table
Numbers Only
8 Ch       954 megabytes
10 Ch     114,688 megabytes
15 Ch    16,106,127,360 megabytes or just a bit more than 31,500 500GB hard drive.
As for letters, lower case only
8 Ch       2,097,152 megabytes
10 Ch     2,147,483,648 megabytes
etc etc ...Got space?

You have now grasped the issue: Running a Bruteforce Attack on blind mode is highly inefficient

If you go "pro", yes, you could: Very large distributed attack can run about 90,000,000,000 tests per seconds, and consume enough electricity to sustain a small town...
I suppose now you understand why Phishing was invented, ditto for Keyloggers.

Nevertheless, you'll be (-may be-) able to crack if you use your brain before.

Test with known passwords first and develop from there.
Use appropriate dictionary files (the Russian one will not help you if you are Japan)
Use your brain
Precompute when possible, If possible
Look for existing data on password occurrence (what is the average password length, most used characters, least used , language, etc )
If you NEED a connection, just ask your neighbor (politely)
Use a 6 or 12 pack as lubricant.
USE Flowers or chocolate if your neighbor is a "she". You may get more than one connection.

You may have heard of the Yahoo! password heist.
10,000 passwords and emails listed on the web, plus another 30,000 accounts of Gmail and Comcast compromised.
According to serious sources, the list was a possible snippet of 250,000 emails and passwords for resale.
Email? not a big deal, huh? who cares? they just need to read your emails, go to your online banking, and reset the password. They will get the message. You won't ....
I could not access the list on time*, but the excellent Reusable Security Blog did
Here is his (Matt Weir) analysis about what you use

*I did later, Including the amazing RockYou heist : 32,600,000 passwords

So on to the analysis:

Total Passwords: 9,845 - This number excludes all the e-mail addresses that had blank passwords
Average Password Length: 8.7 characters long
Percentage that contained an UPPERCASE letter: 7.2%
Percentage that contained a special, (aka !@#$), character: 5.2%
Percentage that contained a digit: 51.7%
Percentage that only contained lowercase letters: 43.3%
Percentage that only contained digits: 17.6%
Percentage the started with a digit, (aka '1password'): 25.0%
Percentage that ended with a digit, (aka 'password1'): 44.1%
Percentage that started with a special character: 0.5%
Percentage that ended with a special character: 2.2%
Percentage that started with an uppercase letter: 6.1%

Overall letter frequency analysis:

aeoi1r0ln2st9mc83765u4dbpghyvfkjAzEIOxRLwSNq.MTC_DB-UP*G@H/ZYF+VJK,\$&X!Q=W?'#")(%^][}< {`>

First character, letter frequency analysis:

a1mbc2sp0lterdjfgn3hi6k759vo48yAwMzBSCuqPLExJRTFDGNV*HOZYKI\W@/-+(.$U&?Q^[,#

Last character, letter frequency analysis:

aos01326e57849nrilydzmtuAhbO.gck*SxpfE@+LvjNRw_-I?/$q!ZX)YKH"UPMDCB#GF'&%}T,]\VJ(

As a repeat, the previous is from Matt Weir, from Reusable Security

          Last but not least:
         GOOD LUCK !

Dictionary files & Passwords lists

KisMAC Resources

2011-06-14T19:00:00.000-04:00

KisMAC Resources, Wordlist, Dictionary files

Is there a KisMAC Tutorial?
Yes, a Video tutorial and a written one. Also a troubleshooting one and a debugger in progress. it's here: http://tinyurl.com/nxdcsd

What injection device should I use?
Definitely this one:
Best Wifi Card for KisMac about 20 X more powerful than Airport or Hawking

This card is a winner hands down!
Mentioning a Hawking or an Edimax as "competition" is a pure act of charity.

Otherwise, The list of “approved” hardware is here: http://trac.kismac-ng.org/wiki/HardwareList
I have tried the Edimax EW-7318 USg, Hawking HWUG1 & HWUG1A (about $40)
I am not really impressed by the sensitivity of the Hawking “as is”, nor by the Edimax.
After few tests and compared to the one mentioned above in "best card" I would not consider buying them again.

Nota Bene:
KisMAC will try every word (from the list provided) to attempt to crack the key, hence it may take a lot of time....if you have a slow machine, be really patient.
I have a not so bad machine, and I run about 170 words per second. You can leave a comment with your config and speed for me to compare.
Mine: MacBook Pro 2.5GHz Intel Core 2 Duo + 4GB DDR2 SDRAM : about 170 Word/sec

Can you find listing or maps of available networks?
-Yes you can, check the Wigle Webpage http://wigle.net

How to uninstall Drivers ? Plist?
Your best shot at uninstalling Plist is to use the free App called "App Cleaner"
You'll find the link, directions, etc, on the blog (left hand side)
If you have installed the drivers provided with a CD for a specific chipset, you will need:
The Admin Rights, the use of Terminal, and you'll need to unload the driver before removing it. Unloading the driver only works for one session: When you'll reboot, the driver will be loaded again.

How to select a single channel?
Take a look at "Step B", the picture shows "all channel selected"
you just have to click on "none" and the check the single channel wanted
you can also use directly the tab "Channel"

I am a Super Geek, is there something more powerful than KisMAC?
Aircrack-ng (Reserved for Advanced User)
How to install Aircrack on a Mac : http://easymactips.blogspot.com/2010/10/how-to-install-aircrack-on-mac.html
Wireshark is also a powerful one, but no so friendly for the beginner

Passwords Lists

One of the best is here:
http://easymactips.blogspot.com/2009/11/support-donate.html

Worst password list: Please, don't use them .....;-) they are often the first checked ....
http://aloah.free.fr/mactips/Wordlists.html
http://trac.kismac-ng.org/wiki/wordlists

List of Dictionary files or Wordlist / Wordlists
Sometimes called wordkey or word key (as per the results of your queries via Google Analytics
for WPA attack:
http://aloah.free.fr/mactips/Wordlists.html
http://trac.kismac-ng.org/wiki/wordlists
or you can compile your own.
I may suggest you to skip passwords of 1,2,3 & 4 characters, very few people use 3 ch passwords... A bruteforce attack will not take a long time on 3 ch....
WPA:
Minimum 8ch, so you can skip all pswd of less than 8 characters.

Note on dictionary files:
the words are tested "as is" and not in combination.
Example: the password is "I love Kismac"
If your dictionary contains the words "I" + "love" + "Kismac" it will NOT work, your dictionary must contain the exact "I love Kismac" as a word to successfully attempt to crack.

This is the only way to end with a successful attack is to use a dictionary containing the (exact) word(s).
Pure Brute Force attacks do NOT work with KisMAC (trying every single combination starting at "a" then "aa", "aaa", etc) You need to provide KisMAC with a dictionary file, format TXT, with an empty line at the end.

Passwords hints
A Dictionary attack uses a list of existing words. Often those lists are all lowercase or mixed, in English, and use "common" words
the more complex is your password, the greater is the chance that it will take a mind-boggling and un-human length of CPU time to try all the possible combination. (million of years)
If you use Kismac on a WPA attack, the only way to end with a successful attack is to use a dictionary containing the (exact) word.
Brute Force attacks do NOT work with KisMAC
As a possible target of WPA attack, "I", use stupid-strength passwords on full ASCII.
I do not use English words, or any common language, and I use lots of $igns and numbers.
So, how patient is the attacker?

Memotechnic tips
Instead of your "123456" dummy password you can use an HARD TO GUESS word and add numbers to it PLUS a second set of numbers while holding the "Shift" key
Example: the maiden name of your mom is Kismac, her Bday is 07 12 1962
you got a "07121962Kismac)&_!@_!(^@"
You just have a 20 Ch length password that you can easily retain.
As KisMac does not use pure Bruteforce to crack WPA, you are pretty safe with a password like this. finding such a word a in dictionary would be...surprising.
Be aware that you can find list of names, towns, zipcodes, etc . So, using "Smith" or "Boston" is not really foolproof

Even in the improbable case of a very, very tenacious "auditor", a 20 character full ASCII password (255 characters possibility) is up to 20^255 possibilities.
How big is 20^255?
well, that's: 1,351,461,283,755,590,000,000,000,000,000,000,000,000,000,000,000
it's already stupid strong. Unless you are the NSA, it's probably out of your reach:

Update on Oct 6 2009.
You may have heard of the Yahoo! password heist*.
*(Dec 2009: Forget the Yahoo! heist, a bunch of highly educated monkeys running a website have left their entire database of passwords in clear plain text. The result is 32,000,000 passwords and login stolen. More on that later....)

10,000 passwords and emails listed on the web, plus another 30,000 accounts of Gmail and Comcast compromised.
According to serious sources, the list was a possible snippet of 250,000 email and password for resale.
Email? not a big deal, huh? who cares? they just need to go to your online banking, and reset the password. They will get the message. You won't ....
I could not access the list on time, but the excellent Reusable Security Blog did
Here is his (Matt Weir) analysis about what you use

So on to the analysis:

Total Passwords: 9,845 - This number excludes all the e-mail addresses that had blank passwords
Average Password Length: 8.7 characters long
Percentage that contained an UPPERCASE letter: 7.2%
Percentage that contained a special, (aka !@#$), character: 5.2%
Percentage that contained a digit: 51.7%
Percentage that only contained lowercase letters: 43.3%
Percentage that only contained digits: 17.6%
Percentage the started with a digit, (aka '1password'): 25.0%
Percentage that ended with a digit, (aka 'password1'): 44.1%
Percentage that started with a special character: 0.5%
Percentage that ended with a special character: 2.2%
Percentage that started with an uppercase letter: 6.1%

Overall letter frequency analysis:

aeoi1r0ln2st9mc83765u4dbpghyvfkjAzEIOxRLwSNq.MTC_DB-UP*G@H/ZYF+VJK,\$&X!Q=W?'#")(%^][}< {`>

First character, letter frequency analysis:

a1mbc2sp0lterdjfgn3hi6k759vo48yAwMzBSCuqPLExJRTFDGNV*HOZYKI\W@/-+(.$U&?Q^[,#

Last character, letter frequency analysis:

aos01326e57849nrilydzmtuAhbO.gck*SxpfE@+LvjNRw_-I?/$q!ZX)YKH"UPMDCB#GF'&%}T,]\VJ(

As a repeat, the previous is from Matt Weir, from Reusable Security

So, it tells me that there are still a large number of people using password vulnerable to dictionary attacks.
Furthermore:
40% of users are using the same password for everything.
92.7% did not use an UPPERCASE
94.8% did not use a special character
and the best: Only contained digits: 17.6%
Average length 8.7 >> rounded to 9 Characters
For the 18% (of dummies) that only use digit:
Digit only = 10 possibility per Ch. 9Ch long = 10^9 = 1,000,000,000 possible combination
Realistic number of test before cracking: 50% (10^4.5)
Time to crack : 0,015 hour = Joke
For those 18%, Read this carefully:
"Neil O'Neil, a digital forensics investigator at secure payments firm The Logic Group, found that "123456" cropped up on the list 64 times. There were 18 uses of the second most popular password, "123456789",
Big surprise!!! Just like the ones mentioned in the 500 most used password. Can you guess what was the #3 and 4#? probably 1234567 and 12345678.
the 500 most used passwords is 4 or 5 yrs old, but it seems like it was brand new.
#1 to #10: 123456,password, 12345678,1234, pussy , 12345, dragon , qwerty , 696969, mustang

So, if I had to create a password list, guess what ..
First on the list would be 8 or 9 Ch long, all digit, then all lowercase, then adding a digit or 2 first, then adding a digit or 2 last.
That list It should cover about 80% of all password.
That would be a big list of 7,518,774,324,736 possibilities, but it would cover 80% of the general public. Not bad.
So, GET A REAL PASSWORD!

Because it's raining and I am bored:
Let 's assume a cluster of 10,000 Macbook Pro, dual core etc, working all together for you (distributed):
A Mac Book Pro, on intensive uses 263 Watt and generates 894 BTU/h output of heat
Cracking possibilities : up to 10,000,000 pswd /second/computer
If you do the math, you'll realize that cracking by brute force a 20 characters Full ASCII password will cost you up to 40 million dollars worth of electricity, create enough BTU to generate a heat wave the size of Texas and take you hundred of thousands of years.
You could hit the jackpot and find the pswd within minutes, but generally, it will take 50% of the maximum time possible to break a password
This is the reason why Keyloggers, Phishing and Clickjacking were invented. That's were, in my opinion, where the real danger is ...

Kismac for Windows
I am not aware of a Windows version of KisMAC (KisDOWS???) , nevertheless, you can Google NetStumbler, Aircrack, Airsnort, etc..
To the best of my knowledge, NetStumbler does not have cracking capabilities, nor the capabilities to uncloak hidden or deauthenticate networks.
If you want serious power, you'll need to forget about Windows (breaking news, huh?) and move on to Linux with Aircrack-ng
If you download a (working) version of KisMAC for Windows, please let me know.
If you download one, especialy from a torrent, I am suggesting you to be VERY careful and scan the file left, right up and down for viruses or malware. ( hint )

How to Install Aircrack on Mac

2011-06-12T13:00:00.003-04:00

How to Install Aircrack on Mac in 3 Easy Steps

Installing Aircrack-ng can be a little confusing if you don't understand the lingo.

Let me guide you trough those steps and you'll have Aircrack running natively in no time and almost no effort.

Why Use Aircrack?

Aircrack-ng is about up to 5 to 10 times faster than KisMAC when it comes to cracking WPA or WEP password.

KisMAC has an old Aircrack Engine and, honestly, it needs an update...

Aircrack-ng 1.1 churns about 1500 "WPA" keys per Second, or about 360 Passphrase/second when KisMAC is left behind at 160/Sec on a dual core.
Aircrack-ng was tested on a MacPro at 1,800 passphrases/sec or 6,100 keys/ sec

Aircrack-ng can recover keys for WEP and WPA. If you are interested in WPA only and want to use the NTWHM (Nukular Turbo Warp Hyperdrive Mode) We would then suggest you to check this post and this post. As a repeat, it's WPA only, but the speed is nothing short of phenomenal:

Yes, it's 1,576,213 PMK/S.
It means 1082.5 times faster than Aircrack.

Back to Aircrack:
On WEP, the difference is extremely noticeable, especially on low IV's captures. Aircrack-ng can work as low as ~23,000 IV's on a 64 bit WEP, and this in matter of seconds. KisMAC will churn for 10 min before giving you the "unable to find the key"
(Update: Success @ 20,566 IV's ;- )
Example here: 3 seconds with 22,566 IV's. Only 753 used.

For Airport users, once decrypted, you have to enter the key without semicolons and space.
Example: 70:61:62:6C:6F will be entered as 7061626C6F or 7061626c6f
If the key was entered as ASCII, Aircrack will also give you the ASCII value

If you are not familiar with the lingo, or wonder what does what, I would suggest reading the FAQ first.

There is multiple ways to install Aircrack-ng, this is one is the most straightforward way (that I am aware of. Suggestions are welcomed in the comment section)

Installing Aircrack-ng on OS X

Gather what you need: The Mise En Place

You'll need:

The DVD or CD install that came with your Mac
A Copy of Aircrack-ng 1.1 (just download, Do NOT unzip)
A Copy of Macports, (OPTIONAL for Install #2) you can download either directly from the website or choose between the following two:
MacPorts for OS X 10.6 (Snow Leopard)
MacPorts for OS X 10.5 (Leopard)
The Admin rights on your Mac, or at least the Admin Password.
In Most Cases you will a Network Adapter to either Re-Inject packets, Flood or Dehauthenticate. You can do without, but you'll need a lot of patience. I only recommend one specific one. If you already have one, well..too bad. if you are going to buy one, you better use the one recommended: Better Value and beat the shit out of the competition

The Installation

Put the Snow Leopard DVD in, and select Optional Installs

Select "Install Xcode " and continue.

When Xcode is fully installed, Remove the DVD and continue with MacPorts

Click on the previously downloaded MacPorts dmg file and let it mount

Select "Standard Install" if asked, and click to continue.

It may take more than 5 minutes to install, don't panic!

While waiting, read the FAQ!

when done, go to the next step

Open Terminal

Go to the folder where Aircrack-ng was downloaded, i.e "Downloads"
Note: Avoid the use of folder names with spaces or you'll make it difficult with Terminal

cd Downloads

sudo port install aircrack-ng

Enter your password as requested, then hit Enter, and let it run....

Voila!

FAQ & RFAQ

Why use Aircrack and not KisMAC alone?
Aircrack-ng can churn 10 x faster than KisMAC alone for Key Recovery.

Can I dump KisMAC now?

No! Aircrack alone can not re-inject or Monitor Wifi. "Mind you, airodump-ng and aireplay-ng are linux only and will not work under OSX native, so for reinjecting and sniffing you will have to use other means." And that's from Aircrack-ng itself. Hence, I'll advise to keep KisMAC. Other tools are provided with the Aircrack-ng suite, but not the ones needed to re-inject. See list at the end.

I cannot find a .cap file

.cap .pcap or dumplog are the same thing. KisMAC exports the file without an extension and Aircrack does not care. KisMAC let you choose the name of the file under Preferences >> Drivers

The format by default is ~/Dumplog year month day hours minutes

Select your options based on your preferences or make your own.

Can I merge Dumplogs / PCAP / CAP files?
Yes, You may use Wireshark ➟ File ➟ Merge

Can I convert Dumplogs / PCAP / CAP files?
Yes, You may use ivstools, provided with Aircrack.
ivstools --convert

Can I Merge IVS files?
Yes, use --merge with ivstools: ivstools --merge

Can I Open Multiple Dumplogs / PCAP / CAP files?
Yes, just use an asterisk (star) (*) with Aircrack
Example: Aircrack-ng Dump*

-->

I can't has a krack! I can has a pazwort?

The subject was previously discussed, here again: sudo make user -now RTFM&STFW. Or box the Mac and ship to me: I'll deal with it.

Aircrack-ng options

Just type Aircrack-ng or Aircrack-ng --help You'll have the whole list

How do I start?

Just start by a simple: aircrack-ng dumplog (dumplog being the name of the capture file, with path if necessary)
Or, if you have opted for very long dumplogs names, with spaces, just drag the file into the Terminal window, and add "Aircrack-ng" before the path. please don't type the quotes....

You'll see a list of APs, enter the network number, ... after that it's pretty straightforward....

Aircrack-ng Command Lines

usage: aircrack-ng [options] <.cap / .ivs file(s)>

Assuming that:
dumplog being the name of your dump file
dicfile.txt being the name of your dictionary files or wordlists , with path if necessary

WEP
aircrack-ng dumplog
Select the number of the AP, then press Enter

WPA
aircrack-ng dumplog -w dicfile.txt
Select the number of the AP, then press Enter

Aircrack-ng Opening Multiple DumpLogs, PCAP, CAP files, on a single network, with automatic key recovery

Aircrack-ng -e dump*

Please note that "dumplog" & "Dumplog" are different. -for aircrack-.

It's easier to "regroup" your files in one directory than typing path long as your arm.
Also, don't hesitate to rename the dumplogs / cap files: "dumplog" is easier to type than "DumpLog-11-02-17-17/40.pcap"
aircrack-ng ~/Desktop/dumplog -w ~/Desktop/Dicfile.txt

If you have located your dumplog in a far far away folder, or have used spaces in your folder name, read again the previous paragraph.
If you decide against that advice, you'll need to include quotes in the file name, or use a backslash BEFORE the space.
Example with the folder Air Crack, the command line would be the following:
~/Desktop/Air\ Crack/Dicfile.txt

Examples:
Aircrack-ng Opening Multiple DumpLogs, PCAP, CAP files, on a single network, with automatic key recovery

-->

Aircrack-ng -e dump*

To Pause Aircrack-ng
Hold your horses! There is no real pause when running a Wordlist on Aircrack-ng
One solution is to stop Aircrack, note carefully the name of the last key checked, and edit your Wordlist few keys before, save under a temp name and restart when ready.
To Stop, just do a CTRL-Z.

To Quit Aircrack-ng CTRL-C

I have multiple Macs, can I speed up the key recovery?
yes, copy the Dumplog and the Dictionary(ies) and use as many as you want. It's called a distributed attack. I would split the Dic in two and reverse one (start from bottom up) or use multiple dictionaries. - Your call.

What about Precomputed Tables?

Yes but no,
The precomputed PMK (Pairwise Master Key) has pros and cons.
The SSID is used as "salt" in the hash, hence you'll have to precompute a different one for each SSID. If you spend your days assessing networks, that, maybe, could be useful with SSIDs such as "Linksys" etc ... but you'll spend a lot of time computing. It is only worth it if you know that you are going to reuse the precomputed table over and over again.
The most used SSIDs are the following.
After many years, Dlink has started assigning different SSIDs to their router (Dlink.1234)
Nevertheless, they are still using very short default password. Thank you D-Link.

no ssid	2110760	6.571%
linksys	2065356	6.429%
NETGEAR	678943	2.113%
default	595090	1.852%
Belkin54g	276667	0.861%
hpsetup	232518	0.723%
Wireless	225838	0.703%
no_ssid	211360	0.658%
DLINK	199668	0.621%
WLAN	120117	0.373%
home	107110	0.333%

Source: WiGLE

Aircrack-ng / KisMAC Speed Test
Test files of 100,000 lines were used:
One with 8 numerical digit, from 00000000 to 99999999
One with complex passphrase of 50 printable characters: !@#$%....ABC....99999
One with 50,000 less than 8 ch and 50,000 more than 8 ch long

Tests were done on a Intel Dual Core 2.5GHz, 4GB RAM

Aircrack Speed:
100,000 Passphrases in 04' 42", or 354.61 Pswd/sec
~1450 K/s

Is Aircrack-ng slowed down by complex passphrase?
100,000 Passphrases in 04' 43", or 353.3 Pswd/sec
Result: difference is negligible: 1 sec overall

Is Aircrack-ng testing less than 8ch passwords?
No, the file containing 50% less than 8ch long passwords was done in 2'12

KisMAC Speed:
100,000 Passphrases in 10' 18", or 161.8 Pswd/sec
2.2 times slower

Is KisMAC testing less than 8ch passwords?
No, the file containing 50% less than 8ch long passwords was done in 4' 27"

Is KisMAC slowed down by complex passphrase?
No, here again, results are almost the same.

Common Aircrack-ng options:

      -a : force attack mode (1/WEP, 2/WPA-PSK)
      -e : target selection: network identifier
      -b : target selection: access point's MAC
      -p : # of CPU to use (default: all CPUs)
      -q         : enable quiet mode (no status output)
      -C : merge the given APs to a virtual one
      -l : write key to file

Static WEP cracking options:

      -c         : search alpha-numeric characters only
      -t         : search binary coded decimal chr only
      -h         : search the numeric key for Fritz!BOX
      -d : use masking of the key (A1:XX:CF:YY)
      -m : MAC address to filter usable packets
      -n : WEP key length : 64/128/152/256/512
      -i : WEP key index (1 to 4), default: any
      -f : bruteforce fudge factor, default: 2
      -k : disable one attack method (1 to 17)
      -x or -x0 : disable bruteforce for last keybytes
      -x1        : last keybyte bruteforcing (default)
      -x2        : enable last 2 keybytes bruteforcing
      -X         : disable bruteforce   multithreading
      -y         : experimental single bruteforce mode
      -K         : use only old KoreK attacks (pre-PTW)
      -s         : show the key in ASCII while cracking
      -M    : specify maximum number of IVs to use
      -D         : WEP decloak, skips broken keystreams
      -P    : PTW debug: 1: disable Klein, 2: PTW
      -1         : run only 1 try to crack key with PTW

WEP and WPA-PSK cracking options:
-w : path to wordlist(s) filename(s)

Other Tools provided with the Aircrack-ng Suite

Ivstools-ng : Merge and convert IV's

Airbase-ng : "Airbase-ng is multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself. Since it is so versatile and flexible, summarizing it is a challenge"

Airdecloak-ng : "Airdecloak-ng is a tool that removes wep cloaking from a pcap file. Some WIPS (actually one) actively “prevent” cracking a WEP key by inserting chaff (fake wep frames) in the air to fool aircrack-ng. In some rare cases, cloaking fails and the key can be recovered without removing this chaff. In the cases where the key cannot be recovered, use this tool to filter out chaff. "
Source: Aircrack-ng.org. Please refer to it for any information related to the Aircrack-ng Suite.

New Rules for Comments:

Update: Some people can read, some others can't: Your time is precious, so is ours: If your question has been previously answered, you'll be asked for a $5 donation. Otherwise, just re-read again.
Please use a name other than "Anonymous" See Name/url . Any name, even Max the Cat will do. Will do only once.
Please State your OS, Version, etc. Don't forget to state your OS.
Max 3 questions. If we need to ask you what is your OS, that will be one, 2 left.

KisMAC Tricks, Hacks and Gotchas

2011-06-11T11:54:00.003-04:00

KisMAC Tricks, Hacks and Gotchas

How To Merge KisMAC Files
How to add / merge IV's

Adding Multiple KisMAC files together will also add the IV's previously captured, and that's good news.
Either open a previously saved file, or save the .kismac file you are working on, then select File >> Import >> KisMAC file
The files will be concatenated (stitched) together. As you can see, this file now contains over 15,000 networks. All IVs previously captured will be added.

By holding the Command Key, you can import multiple files at once.

Result below ;-) IV's added from multiple captures files.

Don't forget to have the settings on "Keep Everything" or "Keep Weak Frames" or you won't be able to keep the IV's on a saved file.

How To Export To Google Earth
You can export the Data Captured to Google Earth, if you plan to "trace" you'll need a GPS, either built-in or on USB. I recommend this GPS, from Amazon: GlobalSat BU-353 Waterproof USB GPS Receiver

Plug the GPS and select /dev/tty/usbserial in the preference pane, under gps.

Don't forget to check "Save Everything" under "Driver"
Once your file has been saved, you can export to Google Earth.

Which USB Card Works the Best?
That's a Gotcha! USB Cards are defined by their Chipset , i.e RT73, Atheros 5001, Prism2
Some will work, some may work, and some will never work.
Be careful with that! Buying the wrong one means a guaranteed failure
After testing few of them, I was surprised to see that the best one is not the most expensive, by far, for ~$35 you can get a USB Card that allows, not only to re-inject or perform attacks such as flood, or deauthentication, but also to get a WIFI contact at up to one mile (1.6km)
If you think it's not impressive, try with your Airport alone.
The tests, reviews and links are here: Best USB WLAN Adapter KisMAC Compatible
One last word: I recommend one card, and one card only. The same card is often found on eBay, sold by pseudo "official vendors" I am warning you that copies and fakes are rampant on eBay; This is why I provide the link for one vendor that is known to be safe: I never had one single complain about him.

How To Create a USB/Firewire Bootable OSX Leopard / Lion

2011-06-10T14:12:00.005-04:00

USB / Firewire Bootable External Drive

Creating a Bootable Firewire or USB Flash or USB External HDD, and it can save one your life one day: Don't wait for the day you crash to enter panic mode or cry misery.

If the steps are too techie, or if you don't feel like playing around, or do not want the hassle, We can do it for you: Look at the bottom of the page to order a pre-configured, up and running, guaranteed to work, External Bootable OS (USB Stick, HDD, USB or FireWire)

The Example below are for OS X Leopard, Snow Leopard and Lion (10.5 10.6 & 10.7)

In order to create a bootable OS X you'll need:

The Install Disc or the OS downloaded from the App Store
A USB Stick, with at least 8GB
Or
An External Hard Drive, either USB or FireWire. Or both

Note: a slow USB Stick will impair the performances! => This one, Corsair USB 2.0 Flash has a read/write speed that leaves the competition in the dust, and is rugged, Shockproof, Waterproof.
and has a 10yrs warranty. The 32GB is less than $20!

This external 1TB HDD works like a charm for me, and are the same as the ones sold from Apple (besides that they are $50 cheaper )

1 TB HDD USB 2.0 + 2 FireWire 800 ports, Mac Edition 2 FireWire 800 port + 1USB 2.0. 3yrs warranty. Up to 786.4 Mbit/s full-duplex transfer speed. Free Shipping

2 TB HDD USB 2.0 + 2 FireWire 800 port, Mac Edition
2 FireWire 800 port, 1USB 2.0. 3yrs warranty. Up to 786.4 Mbit/s full-duplex transfer speed. Free Shipping.

1 TB USB 2.0 HDD Only $87, with free shipping. 3 yrs warranty.

Ready ?

Your Mac is started,

Plug your USB HDD / Flash

Go to Applications >> Utilities >> Disk Utility

You will need to format and partition your disk/flash
The number of partitions is up to you. If you want a full copy (clone), you'll need to leave enough space.
Name (or not) your Volume
Format: The volume must be "Mac OS Extended (Journaled)" . Bottom Right, you should see "GUID Partition Table" , if not, Click on "Options"

Options:
Select "GUID" It is imperative that the volume is formatted with GUID, otherwise it will NOT be bootable.

Once formatted, insert the CD and let run for few seconds, the install screen will pop up.
Do NOT select your already existing Macintosh HD, look at the options below.

Select "Customize" if you wish NOT to install all languages, you probably need only one or two languages, and you will save about 1.2 GB of unused languages.

Once your choice is made, select "Show All Discs" and select the Volume where you want to install. Here the Volume "Mr_Red" has been selected.

Click on "Install" and let run. The full install takes about 35 min + updates. Once installed, OSX will ask if you want to migrate your settings and Applications to the new Install.
Voila, you are 99.9% done

The last step will be to hit the "Software Update" to ensure that everything is up to date.
Go to the Apple icon and click Software Update.

Boot Selection:
You basically have two ways of selecting the boot.

=> At Start, hold the Option Key (or Alt). After few seconds, all the bootable drives will appear. Just make your choice.

left picture credits: Mactalk

=> If already started, Go to System Preferences >> Startup Disk and select which volume you want to restart with.

Warning!

The computer will use that setting by default for the next restart, hence you have to remember that and will need to restart with the Option key to select the right one. If you unplug the USB bootable flash or disk, you'll see a blinking folder at boot. it signals you that OS X can not find the (previous) boot used, just use the Option Key...

We can do it for you!

Do you want a top notch External Bootable OS, either OS X Snow Leopard or Lion (10.6 or 10.7) Configured the right way? fitted to your needs? with no hassle, guaranteed to work?

- We can do it for you, upon your specifications, tailored to your needs:

- Single or Multiple Partitions, Single or Dual Boot, From 8GB USB Flash to a 2TB External HDD, Shipped USPS w/ Tracking number.

- You will receive a Genuine Retail Install DVD, No "copies" or shenanigans. The USB Flash are top notch quality, Shockproof 40G, SplashProof, and come with a 5 to 10 yrs warranty depending on model.
Upon your request, we can preload multiple free apps and/or Sophos Mac Edition for Home, Running & updated. Just take a look a this page, all the details and conditions are there.

.

With Love, Signed: Darwin.

2011-06-09T15:46:00.004-04:00

Whatever you believe in, Evolution or Pseudo Intelligent Design*, some of those below really need to be removed from the gene pool, or a least, to be taught effective contraception.

Few months ago I wrote about the Gawker Hack, pointing out that companies are using obsolete technologies to "protect" your data. And that is, when they do: Some UberMorons are still leaving your data in plain clear text. (RockYou: 32 million account stolen), Or some other like to taunt hackers (Gawker again)
The only reason they do so is pure greed: They seem to enjoy paying huge PR and lawyers fees, apologizing to you, and changing in a hurry 130,000,000 credit card numbers (TJMAXX) instead of spending few thousands dollars in security. Well, they prefer to spend the money on Golf meetings or sushis, after all, you are paying the bill, not them.
But, the technologies used to protect a website are only one level of protection, the second level is depending on your ... IQ.
Yes, your own IQ. And sometimes, that's the problem...

Even if your password is hashed, the simpler it is, the faster it is to crack it. JTR (John The Ripper) and my miserable MBP can crack the first few thousand in a matter of minutes. After that, it slows down... after few hours, it really slows down and get boring.
When getting bored, switch to oclHashCat (Win/Linux)
LulzSec, or any other Hack group, have probably a botnet or few computers at their fingertips: They could chop-chop few hundred million tries per second, but it's still a drop in the bucket* -encryption wise-, so the longer is your password, or the less common it is, the harder it is to crack it. Remember: They are not looking for your password, they are looking for the weakest ones. You just need to be stronger than the next guy.
Below, the hack of Infragard, a partner of the FBI. One would expect stronger website when it comes to national security, no? Also, Richard, please don't use use your name as password... you should do better, for Christ sake!
= means hash was cracked, password discovered.

At the light of the LulzSec hacks, a bunch of data has been released in the wild, and it seems to confirm that we are losing the battle of evolution.    Few examples:

Rule #1

When you own an official email address from the White House, please don't use it for login in porn sites. especially if your password is stolen with it.    Also, on a side note: Go back to work...
Ditto when you are an active USAF pilot fighter, also don't use "Mywife01" when you visit porn sites AND login with your OFFICAL email address.    Also, on a side note: Go back to work...

Rule #2
When you work for Fox TV, particularly in Fox Sales, don't use "foxsales" as your password

Rule #3
If you use your domain name as password, you are officially a moron.
That list has been hugely truncated. After #50, it's not funny anymore.

Rule #4
When you are the CEO of a high tech company, you should not use the same password for everything, because having your emails stolen, your secret conference calls listened to, your colleagues duped, your private info leaked, etc ... it's not called being hacked, it's called being raped.   Having different passwords is called "Best Practices"

"...Because (Karim) Hijazi (CEO of Unveillance) had used the same password on the InfraGard site that he used on his personal Gmail account and his corporate Google Apps account, the hackers were easily able to spy on his personal and business activities..."
Source: Cnet News http://tinyurl.com/6js2q5o

Rule #5
"123456" as a password shall not be allowed, nor "password" or the great "123456789"
As a repeat, list of most used passwords are easy to find, and JTR will chop chop in seconds.
Respectively Rank, Occurrence, Password

   1: 1240: 123456
   2: 396: 123456789
   3: 197: password
   4: 161: 12345
   5: 119: 1234
   6: 108: 123
   7: 104: 12345678
   8: 93: 1234567
   9: 88: romance
10: 72: 102030

That's it folks, I am going to return sifting trough the data ...

* Intelligent Design: Don't get me going...
** That is when you salt your hash, you freaking greedy morons (Linkedin, eHarmony, Last.fm)

.

How To Install John The Ripper on a Mac

2011-06-07T14:34:00.003-04:00

How To Install JTR on a Mac.

John The Ripper is a cracking password program, also known as JTR or john.
John The Ripper is not for the beginner, and does NOT crack WPA (alone) (by itself) (solely)***
You must be able to use Terminal, there is no GUI. Read the Terminal notes at the end
This is a pre-compiled install. If you wish to install from scratch, you'll need Xcode.

This Pre-compiled install is not the best ~per se~, by default John The Ripper is "Single Core"on this version, and does not always includes the latest patches.
See the benchmark at the end for other build: 32bit Vs 64bit.

How to install John The Ripper on a Mac, Pre-compiled version

Update #1
As everybody, I don't read the whole page.... bummer, buried in the last lines, there is a direct link ...
So you can download JTR the easy way ....
http://download.openwall.net/pub/projects/john/contrib/macosx/
please bear in mind that I still highly suggest to read the (this) page, just skip the manual download part...

Old fashion manual download

Open Terminal

In Terminal, Type

ftp ftp.openwall.com

The result should be:
Connected to ftp.openwall.com. 220 ftp.openwall.com - hosted by DataForce ISP - http://www.openwall.com/DF/ Name (ftp.openwall.com:"User Name"):

Type "anonymous" for login

anonymous

RE-Type "anonymous" for password

anonymous

Once logged in, Type the following

cd pub

cd projects

cd john

cd contrib

cd macosx

Or because you are smart, just copy and paste

cd pub/projects/john/contrib/macosx

Then make a dir for the listing

dir

You should see a listing with a line named something like:
Dec 12 2010 john-1.7.6-jumbo-9-macosx-universal-1.zip

Use the get command along with the name of the file. hint: copy-paste again.

Get john-1.7.6-jumbo-9-macosx-universal-1.zip

The download will start shortly

Opening BINARY mode data connection for john-1.7.6-jumbo-9-macosx-universal-1.zip (2120620 bytes).
100% |**| 2070 KiB 507.22 KiB/s 00:00 ETA
226 Transfer complete.
2120620 bytes received in 00:04 (487.87 KiB/s)

Exit the FTP by typing:

exit

The file is now located in the root folder of your Mac , i.e Macintosh HD
Go there and unzip the file.
For the Sake of clarity, rename the folder to john, JTR, or whatever fits you:
Typing "cd /john-1.7.6-jumbo-9-macosx-universal-1/run" is longer than "cd /jtr/run"

Type cd "with your path"

cd /john/run

Or
If you really like to complicate your life: Use a long name, in a distant folder with spaces, preferably. Piping directly into Aircrack-ng is also possible.***

Cd /Volumes/Mr\ Blue/Cracking\ Soft/john-1.7.6\ jumbo\ 9\ macosx\ universal\ 1/run | ./john --test

Test john The Ripper with the benchmark

./john --test

For the manual, how to use it, etc

./john

***
You can pipe an output of JTR into Aircrack, See --stdout and/or --incremental on the JTR wiki

Benchmark
This Benchmark was done using the same 2.5 GHz Dual Core, using 3 different build of John The Ripper, each time Single/Dual Core mode , the test was 5 sec for a Raw SHA1 hash .

./john --test=5      5 sec for each benchmark instead of the 1 sec default value

JTR OSX Build Single Core
Benchmarking: dynamic_26: sha1($p) raw-sha1 [4x2]... DONE
Raw:    8226K c/s real, 8411K c/s virtual

JTR 32 bit SSE2 Single Core
Benchmarking: dynamic_26: sha1($p) raw-sha1 [4x1]... DONE
Raw:    8285K c/s real, 8285K c/s virtual

JTR 64 bit Single Core
Benchmarking: dynamic_26: sha1($p) raw-sha1 [4x1]... DONE
Raw:    7500K c/s real, 7500K c/s virtual

JTR 32 bit SSE2 Dual Core
Benchmarking: dynamic_26: sha1($p) raw-sha1 [4x1]... (2xMPI) DONE
Raw:    16312K c/s real, 16510K c/s virtual

JTR 64 bit Dual Core
Benchmarking: dynamic_26: sha1($p) raw-sha1 [4x1]... (2xMPI) DONE
Raw:    14468K c/s real, 14916K c/s virtual

The 32 bit version is faster on that case, on Raw Sha-1 because of the SSE2, this is not the case with all Hashes.

Notes

Cracking Speed
The Cracking speed will highly depend on the quality of your Wordlist, the default file password.lst located in ./John/run is not the best. By far...   You might want to try one of those Wordlists
Check also the --rules option
Of course, having a multi-core build (x2, x4, etc) will greatly help

Terminal Notes
The FTP has a short timeout: Don't go away for too long or you'll be kicked out and will have to restart from scratch.   If you are kicked out too many times, you'll end up blacklisted for few hours.
You must be logged as "anonymous"
If your path is a bit long, rename the directory.   You can always drag the files into Terminal, that will save some typing.

John The Ripper Best Practices
- As you type the path and names, avoid long and complex names for files and directories
- Place your files either in ~/Run or on the Desktop
- You can always drag and drop the files into Terminal, that will save some typing. (it's a repeat, just in case you've missed it)

- Create a Session, if you need to stop the cracking, you can always re-start where you left, and not from scratch...

1) Create a Session and give it a NAME, example "Likedin" and indicate the file containing the Hashes to be cracked. -With- Path if necessary. "crackme.txt" being the file containing the hashes to be cracked

./john --session=Likedin crackme.txt

- If you press a key while JtR is working, you'll see the progress, as:

guesses: 0 time: 0:00:00:01 2.59% (ETA: Wed Jun 13 16:40:27 2012) c/s: 197606K trying: B62608 - BABARO6
ETA is the ESTIMATED time of arrival
c/s: "The values displayed by John mean combinations (of username and password) per second, not crypts per second. This is the effective cracking speed that you get on a particular set of password hashes" www.openwall.com
here: 197,606,000

John The Ripper Tutorial and Quick Tips

John The Ripper Known Bugs

Crash Recovery File is Locked

When quitting John or interrupting a session, use CTRL-C and NOT CTRL-Z
Using CTRL-Z will leave a process running. If you have multiple process running you'll get this error. You can kill / check those processes in Activity Monitor.

***
You can pipe an output of JTR into Aircrack, See --stdout and/or --incremental on the JTR wiki

Manual
John the Ripper password cracker, version 1.7.6-omp-des-jumbo-9
Copyright (c) 1996-2010 by Solar Designer and others
Homepage: http://www.openwall.com/john/

Usage: john [OPTIONS] [PASSWORD-FILES]
--config=FILE              use FILE instead of john.conf or john.ini
--single[=SECTION]         "single crack" mode
--wordlist=FILE --stdin    wordlist mode, read words from FILE or stdin
--rules[=SECTION]          enable word mangling rules for wordlist mode
--incremental[=MODE]       "incremental" mode [using section MODE]
--markov[=LEVEL[:START:END[:MAXLEN]]] "Markov" mode (see documentation)
--external=MODE            external mode or word filter
--stdout[=LENGTH]          just output candidate passwords [cut at LENGTH]
--restore[=NAME]           restore an interrupted session [called NAME]
--session=NAME             give a new session the NAME
--status[=NAME]            print status of a session [called NAME]
--make-charset=FILE        make a charset, FILE will be overwritten
--show[=LEFT]              show cracked passwords [if =LEFT, then uncracked]
--test[=TIME]              run tests and benchmarks for TIME seconds each
--users=[-]LOGIN|UID[,..] [do not] load this (these) user(s) only
--groups=[-]GID[,..]       load users [not] of this (these) group(s) only
--shells=[-]SHELL[,..]     load users with[out] this (these) shell(s) only
--salt-list=SALT[,SALT,..] load just the specified salt(s)
--salts=[-]COUNT[:MAX]     load salts with[out] at least COUNT passwords only
                           (or in range of COUNT to MAX)
--pot=NAME                 pot file to use
--format=NAME              force hash type NAME:
                           DES/BSDI/MD5/BF/AFS/LM/NT/XSHA/PO/raw-MD5/MD5-gen/
                           IPB2/raw-sha1/md5a/hmac-md5/phpass-md5/KRB5/bfegg/
                           nsldap/ssha/openssha/oracle/oracle11/MYSQL/
                           mysql-sha1/mscash/lotus5/DOMINOSEC/
                           NETLM/NETNTLM/NETLMv2/NETNTLMv2/NETHALFLM/MSCHAPv2/
                           mssql/mssql05/epi/phps/mysql-fast/pix-md5/sapG/
                           sapB/md5ns/HDAA/raw-md4/md4-gen/sha1-gen
--subformat=NAME           Some formats such as MD5-gen have subformats
                           (like md5_gen(0), md5_gen(7), etc).
                           This allows them to be specified.
                           If the name is LIST, then john will show all
                           subformats (help mode), and exit
--save-memory=LEVEL        enable memory saving, at LEVEL 1..3
--mem-file-size=SIZE       max size a wordlist file will preload into memory
                           (default 5,000,000 bytes)
--field-separator-char=c   Use 'c' instead of the ':' for processing fields
                           (input file, pot file, etc)
--fix-state-delay=N        only determine the wordlist offset every N times
                           It is a performance gain to delay a while
                           (say 100 loops for a fast algorithm).
                           For slow algorithms it should not be used

.